fix(session): require config-backed mutation authority and workspace-bound targets (#714)

Close the #714 remediation gap left at 943d402 where env-only mutation
profiles, REMOTES Timesheet defaults treated as explicit caller input, and
machine-dependent Git remotes produced false greens.

- Fail closed when mutations lack a config-backed profile with non-empty
  allowed_repositories; env ops cannot invent mutation authority.
- Preserve omitted-vs-explicit org/repo provenance through the mutation
  gate; omitted targets bind to the verified workspace repository.
- Prefer workspace-aligned Git remotes over historical Timesheet defaults
  in MCP _resolve and CLI resolve_remote.
- Centralize deterministic config-backed mutation fixtures; migrate
  mutation tests off env-only authority without weakening security
  assertions.

Full suite: 2744 passed, 6 skipped.

tests/test_issue_714_production_first_bind.py

@@ -185,7 +185,11 @@ class TestProductionOrderRepositoryDriftBlocks(_ProductionOrderBase):
         with patch.dict(os.environ, self._env, clear=False), self._live():
             srv.gitea_whoami(remote="prgs")
             blocked = srv._session_context_mutation_block(
-                remote="prgs", org=WORKSPACE_ORG, repo="Timesheet"
+                remote="prgs",
+                org=WORKSPACE_ORG,
+                repo="Timesheet",
+                org_explicit=True,
+                repo_explicit=True,
             )
             self.assertIsNotNone(blocked)
             self.assertTrue(
@@ -380,13 +384,23 @@ class TestConcurrentFirstBindSelectsOneRepository(_ProductionOrderBase):
 
 
 class TestRepositoryScopeUnits(unittest.TestCase):
-    def test_absent_scope_is_not_enforced(self):
+    def test_absent_scope_is_not_enforced_for_read_diagnostics(self):
         scope = session_ctx.assess_repository_scope(
             workspace_slug=WORKSPACE_SLUG, allowed=[], profile_name="legacy"
         )
         self.assertTrue(scope["proven"])
         self.assertFalse(scope["scope_enforced"])
 
+    def test_require_scope_blocks_empty_or_missing_allowlist(self):
+        scope = session_ctx.assess_repository_scope(
+            workspace_slug=WORKSPACE_SLUG,
+            allowed=[],
+            profile_name="legacy",
+            require_scope=True,
+        )
+        self.assertTrue(scope["block"])
+        self.assertTrue(any("allowed_repositories" in r for r in scope["reasons"]))
+
     def test_declared_scope_authorizes_only_listed_repository(self):
         allowed = session_ctx.declared_allowed_repositories(
             {"allowed_repositories": [WORKSPACE_SLUG]}
@@ -435,7 +449,7 @@ class TestRepositoryScopeUnits(unittest.TestCase):
             )["proven"]
         )
 
-    def test_malformed_allowlist_entries_are_ignored(self):
+    def test_malformed_allowlist_entries_are_ignored_in_non_strict_mode(self):
         self.assertEqual(
             session_ctx.declared_allowed_repositories(
                 {"allowed_repositories": ["not-a-slug", 17, None, WORKSPACE_SLUG]}
@@ -443,6 +457,53 @@ class TestRepositoryScopeUnits(unittest.TestCase):
             [WORKSPACE_SLUG],
         )
 
+    def test_strict_mode_rejects_malformed_allowlist_entries(self):
+        with self.assertRaises(ValueError):
+            session_ctx.declared_allowed_repositories(
+                {"allowed_repositories": ["not-a-slug", WORKSPACE_SLUG]},
+                strict=True,
+            )
+
+
+class TestRemotesDefaultNotCallerOverride(_ProductionOrderBase):
+    def test_resolved_timesheet_default_does_not_block_when_bound_to_workspace(self):
+        """Tools historically pass REMOTES-filled Timesheet after _resolve; that
+        must not be treated as an explicit override against Gitea-Tools."""
+        with patch.dict(os.environ, self._env, clear=False), self._live():
+            srv.gitea_whoami(remote="prgs")
+            # Simulate create_issue after resolve: org/repo are REMOTES defaults
+            blocked = srv._session_context_mutation_block(
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Timesheet",
+            )
+            self.assertIsNone(blocked, getattr(blocked, "get", lambda *_: blocked)("reasons") if blocked else None)
+
+    def test_git_unavailable_blocks_mutation(self):
+        def no_remote(_name):
+            return None
+        with patch.dict(os.environ, self._env, clear=False), self._live():
+            with patch.object(srv, "_local_git_remote_url", side_effect=no_remote):
+                blocked = srv._session_context_mutation_block(remote="prgs")
+                self.assertIsNotNone(blocked)
+                self.assertTrue(
+                    any(
+                        "workspace" in r.lower() or "allowed_repositories" in r or "unverified" in r
+                        for r in blocked["reasons"]
+                    ),
+                    blocked["reasons"],
+                )
+
+    def test_explicit_mismatch_still_blocks(self):
+        with patch.dict(os.environ, self._env, clear=False), self._live():
+            srv.gitea_whoami(remote="prgs")
+            blocked = srv._session_context_mutation_block(
+                remote="prgs",
+                org=WORKSPACE_ORG,
+                repo="Other-Tools",
+            )
+            self.assertIsNotNone(blocked)
+
 
 if __name__ == "__main__":
     unittest.main()