[mikelangmayr]

• 42 tests covering the four things that were verified by hand, once, and that nothing stopped a future edit from breaking: rendering the host artefacts, target resolution, secrets discovery and deploy planning.
• Fixtures build a throwaway host tree and the tests do real directory reads, stubbing only systemd. The instrument under test is demo, not hispec, so a leaked hispec name fails a test.
• The rendering tests assert no @placeholder@ survives. That is what catches a template gaining a variable nobody wired up, which would otherwise reach a host as a literal @user@ inside a unit file.
• Checked the tests actually bite by breaking six things deliberately: a unit running as root, a polkit rule scoped to wheel, an unwired template variable, the host-assignment guard removed, duplicate targets no longer dropped, and the secrets suffix hardcoded. All six fail the suite.
• pytest is in a test extra, so it never reaches a deployment venv.