fix(sandbox): audit --tests-dir bypass EXCLUDE_DIRS; probe path in regression test

tests/test_test_sandbox.py

@@ -93,21 +93,19 @@ def test_audit_subprocess_bad_dir_exits_one() -> None:
 
 
 def test_sandbox_blocks_writes_outside_tests_dir() -> None:
- """A write to <project_root>/manual_slop.toml raises TEST_SANDBOX_VIOLATION."""
- bad_path = Path(__file__).resolve().parent.parent / "manual_slop.toml"
- if bad_path.exists():
-  original = bad_path.read_bytes()
-  existed = True
- else:
-  existed = False
-  original = b""
+ """A write to <project_root>/manual_slop.toml raises TEST_SANDBOX_VIOLATION.
+ Per Python's sys.addaudithook contract, raising RuntimeError in the hook
+ aborts the open() call (the file is NOT created/truncated).
+ [C: tests/conftest.py:_sandbox_audit_hook]"""
+ bad_path = Path(__file__).resolve().parent.parent / "_test_sandbox_probe.txt"
  try:
-  with pytest.raises(RuntimeError, match="TEST_SANDBOX_VIOLATION"):
+  with pytest.raises(RuntimeError, match="TEST_SANDBOX"):
    bad_path.write_text("corrupt", encoding="utf-8")
+  assert not bad_path.exists(), (
+   f"TEST_SANDBOX_VIOLATION: file {bad_path} should NOT have been created"
+  )
  finally:
-  if existed:
-   bad_path.write_bytes(original)
-  elif bad_path.exists():
+  if bad_path.exists():
    bad_path.unlink()