test(preflight): isolate ORCH-044 auth-gate in TestPreflight (fix CI on credless runner)

TestPreflight asserts version-branch ok; new token-free auth gate reads /home/slin/.claude/.credentials.json regardless of HOME, so a clean CI runner without creds made check() return ok=False -> assert False is True. Add class-scoped autouse fixture stubbing _check_auth green. Auth itself stays covered by tests/test_preflight_auth.py; preflight_check_auth default True unchanged.

tests/test_resilience.py

@@ -37,6 +37,17 @@ def fresh_db(tmp_path, monkeypatch):
 # A. Preflight
 # ---------------------------------------------------------------------------
 class TestPreflight:
+    @pytest.fixture(autouse=True)
+    def _isolate_auth_gate(self, monkeypatch):
+        # ORCH-044: preflight.check() also runs a token-free auth gate reading
+        # <AGENT_HOME>/.claude/.credentials.json (AgentLauncher.AGENT_HOME, not the
+        # process HOME). In a clean CI runner those creds are absent, so the gate
+        # returns (False, ...) and version-branch assertions would fail for purely
+        # environmental reasons. Stub the gate green; auth is covered by
+        # tests/test_preflight_auth.py. Production default (preflight_check_auth=True)
+        # is unchanged.
+        monkeypatch.setattr(preflight, "_check_auth", lambda: (True, "auth ok (test stub)"))
+
     def test_fail_when_bin_missing(self, monkeypatch):
         monkeypatch.setattr(preflight, "_claude_bin", lambda: "/no/such/claude")
         ok, reason = preflight.check(force=True)