feat: govern shared campaign artifact storage

tests/test_response_security.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-import stat
 import unittest
 from datetime import UTC, datetime
 from types import SimpleNamespace
@@ -307,20 +306,18 @@ def test_diagnostics_permission_is_operator_only_by_default() -> None:
     assert "campaigns:diagnostic:read" not in role_permissions["campaign_reviewer"]
 
 
-def test_campaign_snapshot_with_inline_credentials_is_owner_only(tmp_path, monkeypatch) -> None:
+def test_database_campaign_config_is_not_mirrored_to_node_local_disk(tmp_path) -> None:
     from govoplan_campaign.backend.persistence import campaigns as persistence
 
-    snapshots = tmp_path / "snapshots"
-    output = tmp_path / "generated"
-    monkeypatch.setattr(persistence, "CAMPAIGN_SNAPSHOT_DIR", snapshots)
-    monkeypatch.setattr(persistence, "BUILD_OUTPUT_DIR", output)
-    path = persistence._write_campaign_snapshot(  # type: ignore[arg-type]
-        SimpleNamespace(id="version-secret", raw_json={"server": {"smtp": {"password": "secret"}}})
+    path = persistence._campaign_reference_path(  # type: ignore[arg-type]
+        SimpleNamespace(
+            source_base_path=str(tmp_path),
+            raw_json={"server": {"smtp": {"password": "secret"}}},
+        )
     )
 
-    assert stat.S_IMODE(path.stat().st_mode) == 0o600
-    assert stat.S_IMODE(snapshots.stat().st_mode) == 0o700
-    assert stat.S_IMODE(output.stat().st_mode) == 0o700
+    assert path == tmp_path / "campaign.json"
+    assert list(tmp_path.iterdir()) == []
 
 
 class ResponseSecurityTests(unittest.TestCase):