fix(assessment): constrain installed record reads

tests/test_capability_fit_evidence.py

@@ -11,6 +11,7 @@ import sys
 import tempfile
 from types import SimpleNamespace
 import unittest
+from unittest import mock
 
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
@@ -217,11 +218,12 @@ class CapabilityFitEvidenceTests(unittest.TestCase):
             root = Path(temp_dir)
             distribution, payload_file = create_distribution(root)
 
-            evidence = collect_installed_composition(
-                assessment=self.assessment,
-                collected_at=datetime(2026, 7, 22, 12, tzinfo=UTC),
-                distributions=[distribution],
-            )
+            with mock.patch.object(sys, "path", [str(root), *sys.path]):
+                evidence = collect_installed_composition(
+                    assessment=self.assessment,
+                    collected_at=datetime(2026, 7, 22, 12, tzinfo=UTC),
+                    distributions=[distribution],
+                )
 
             self.assertEqual(
                 (), validate_payload(payload=evidence, schema=self.installed_schema)
@@ -234,11 +236,12 @@ class CapabilityFitEvidenceTests(unittest.TestCase):
             self.assertNotIn("file://", encoded)
 
             payload_file.write_text("tampered\n", encoding="utf-8")
-            tampered = collect_installed_composition(
-                assessment=self.assessment,
-                collected_at=datetime(2026, 7, 22, 12, tzinfo=UTC),
-                distributions=[distribution],
-            )
+            with mock.patch.object(sys, "path", [str(root), *sys.path]):
+                tampered = collect_installed_composition(
+                    assessment=self.assessment,
+                    collected_at=datetime(2026, 7, 22, 12, tzinfo=UTC),
+                    distributions=[distribution],
+                )
 
         self.assertEqual(
             "mismatch", tampered["artifacts"][0]["record_integrity"]["status"]