[rdpollard]

The CI scope-policy test inherited real GITHUB_REF, GITHUB_SHA and push metadata on main. Its mocked non-PR scenario therefore entered the legitimate infrastructure-only main-push branch and failed a test assertion. PR CI had passed because its inherited ref was a PR ref.

Clear the environment for that scenario and rename it to state the actual missing-main-metadata condition. No production classifier, activation gate or runner workflow changes. Reproduced the pre-fix failure using a synthetic main-push payload, then verified all 9 scope tests pass with those same enclosing environment variables; the 3 inventory policy tests and actionlint also pass.

This follow-up repairs #74's post-merge checks. Runner activation variables remain untouched; no registration/start, dispatch, guest test, application build/package or release operation is added. PR #73 remains draft/unmerged. The exact infrastructure path remains classified as application CI not required.

[rdpollard]

Reviewed c6c36fc: the change only isolates a mocked test from inherited GitHub push metadata and corrects its name. Reproduced the previous failure and verified all 12 local scope/inventory tests with the same outer main-push metadata. No classifier or access-policy changes. Policy/scope/workflow/Windows CI pass; waiting for Mint fixture CI before merging. Activation variables, runner registration/start and workflow dispatch remain untouched.