fix(test): repair slm sweep run-phase order-rot + never-run files (#11798)

[mrveiss]

Closes #11798

Thinking Path

With collection fixed by #11794, the run phase showed 105 failures + 36 errors: never-run files (real-load treatment), runtime sys.modules clobbering, and per-file/sweep-order rot. Fixed in 5 incremental commits by cluster, polluter-side first, using the established patterns (real-load prologues, snapshot/restore, #9780 parent-attr binding).

What Changed

• Cluster A (45): never-run sso_secrets/sso_e2e tests real-loaded (real sqlalchemy+aiosqlite, encryption service w/ test key, legacy vault path); ldap3-decorated tests get declared-dep env skips.
• Cluster B (25): test_sso_auth.py in-function permanent stubbing → snapshot/restore helper (file now 15/15 solo, was 1/15); monitoring pathless squat → hollow real-__path__ package converged on one shared stub; forced saml enum stub under existing rollback.
• Cluster C (46): 12 files repaired against current contracts — incl. main_ensure_local_node_test loading the WRONG main.py (repo root, parents bug), jwks_verifier_test silently replaced by a MagicMock parent auto-attr in sweeps, test_scim mutating the REAL fastapi.responses.JSONResponse.
• Product bugs fixed in-scope (test-evidenced): sso_secrets._legacy_retrieve swallowed decryption failures when the legacy table is the PRIMARY store — corruption masqueraded as "no secret"; now strict-raises. oidc_token_cache raised through its documented "Redis down → cache miss" contract, breaking token verification/logout — new _redis_or_none() degrades all 3 sites (9 in-sweep TypeErrors → 0).
• Filed autobot_shared: Redis connection-manager singleton created under test-stubbed config poisons every later get_async_redis_client() caller (TypeError in _record_failure) #11830: connection-manager singleton poisoning under test-stubbed config (fix direction recorded).

Verification

• Whole sweep: 105 failed / 1111 passed / 36 errors → 1226 passed / 3 justified skips / 0 failed / 0 errors (agent AND independent re-run identical, 57s). Collection 1229/0; tests/services/ 321/1 intact. flake8 clean on every touched file.

Model Used

Claude Fable 5 (subagent: general-purpose)

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!