fix(runtime): enforce functional containment after closing execution bypasses (ODY-141)

tests/test_workspace_artifact_tool_floor.py

@@ -2198,8 +2198,9 @@ def test_python_loaded_code_sees_virtual_workspace_alias(monkeypatch, tmp_path):
     import venv
     from types import SimpleNamespace
 
-    if not shutil.which("bwrap"):
-        return
+    from src import containment
+    if not containment._bwrap_available():
+        pytest.skip("functional bubblewrap namespaces unavailable")
 
     from pathlib import Path
 
@@ -2238,6 +2239,7 @@ def test_workspace_namespace_mounts_only_a_nested_python_environment(monkeypatch
     from src.agent_tools import subprocess_tools
 
     monkeypatch.setattr(subprocess_tools.shutil, "which", lambda name: "/usr/bin/bwrap")
+    monkeypatch.setattr(subprocess_tools.containment, "_bwrap_available", lambda: True)
     environment = tmp_path / "nested" / "venv"
     environment.mkdir(parents=True)
     (environment / "pyvenv.cfg").write_text("home = /usr/bin\n")
@@ -2259,6 +2261,7 @@ def test_workspace_namespace_rejects_broad_or_symlinked_python_prefixes(monkeypa
     from src.agent_tools import subprocess_tools
 
     monkeypatch.setattr(subprocess_tools.shutil, "which", lambda name: "/usr/bin/bwrap")
+    monkeypatch.setattr(subprocess_tools.containment, "_bwrap_available", lambda: True)
     linked_root = tmp_path / "linked-root"
     linked_root.symlink_to("/", target_is_directory=True)
     # Compared against the argv with no interpreter prefix at all: an unsafe
@@ -2290,6 +2293,7 @@ def test_workspace_namespace_preserves_the_64_bit_dynamic_loader(monkeypatch):
     from src.agent_tools import subprocess_tools
 
     monkeypatch.setattr(subprocess_tools.shutil, "which", lambda name: "/usr/bin/bwrap")
+    monkeypatch.setattr(subprocess_tools.containment, "_bwrap_available", lambda: True)
     command = subprocess_tools._wrap_workspace_namespace("echo ok", "/tmp/workspace")
     assert command is not None
     args = shlex.split(command)