ci(e2e-full): fix 3 nights of red nightly — two independent bugs

Bug 1: test_concurrent_approval_race.cjs 2/4 sub-tests failed with
"Removing detection rules is not permitted. An admin must enable it
in the Control Panel." The test submits action=remove_rule as an
analyst, but setup_test_env.sh only seeded the four CREATE-side
toggles (Phase 0.3.1 fix scope), leaving the four DELETE-side toggles
at their DEFAULT_LIMITS=false. Mirroring the Phase 0.3.1 shape:

  setup_test_env.sh limits payload now also seeds:
    allow_analyst_delete_rules   = true  (gate at wl_handler.py L3000)
    allow_analyst_delete_csv     = true  (gate at wl_handler.py L2888)
    require_reason_rule_deletion = true  (routes remove_rule to queue)
    require_reason_csv_deletion  = true  (routes remove_csv to queue)

Bug 2: test_dual_superadmin.cjs + test_audit_stress.cjs were in the
"Non-destructive (no WL_TEST_HARNESS)" block of e2e-full.yml, but
both files call H.assertTestHarness() which throws when the env var
is unset. Result: every nightly since 2026-05-21 failed with
"REFUSING to run destructive test helper" the moment Dual superadmin
launched — cascading 4 subsequent destructive tests (Audit stress,
Cooldown tamper, Adversarial hardening, Admin limits) into skipped.

Fix: moved both steps into the "Destructive (WL_TEST_HARNESS=1
inline)" block with the env var set. test_visual_regression.cjs has
NO assertTestHarness call and correctly stays in the non-destructive
block.

Independent evidence each bug exists:
  - Run 26325483550 (2026-05-23) log line 1305: explicit
    "submit failed: This operation is not permitted" on remove_rule
    inside test_concurrent_approval_race.cjs.
  - Same run line 1458: "REFUSING to run destructive test helper:
    WL_TEST_HARNESS=1 is not set" thrown from
    tests/e2e/lib_helpers.cjs:194 (the assertTestHarness call).

Verification path: next nightly (or manual workflow_dispatch on
e2e-full.yml) should show all six previously-skipped destructive
steps running, and approval-race PASSED: 4/4 instead of 2/4.

Author: RelativisticJet

.github/workflows/e2e-full.yml

@@ -132,19 +132,25 @@ jobs:
       - name: State machine
         run: node tests/e2e/test_state_machine.cjs
 
-      - name: Dual superadmin
-        run: node tests/e2e/test_dual_superadmin.cjs
-
-      - name: Audit stress
-        run: node tests/e2e/test_audit_stress.cjs
-
       - name: Visual regression
         run: node tests/e2e/test_visual_regression.cjs
 
       # ── Destructive tests (WL_TEST_HARNESS=1 inline) ─────────────
       # Per tests/e2e/README.md run-order guidance: cooldown tamper
       # first (resets KV state cleanly), then adversarial (heavy),
       # then admin_limits last (resets counter at start, safe).
+      #
+      # Dual superadmin + Audit stress moved here 2026-05-22 — both
+      # invoke H.assertTestHarness() so they REQUIRE WL_TEST_HARNESS=1
+      # inline; they were previously mis-classified in the non-
+      # destructive block above and ran red on every nightly since
+      # 2026-05-21 with "REFUSING to run destructive test helper".
+
+      - name: Dual superadmin (destructive)
+        run: WL_TEST_HARNESS=1 node tests/e2e/test_dual_superadmin.cjs
+
+      - name: Audit stress (destructive)
+        run: WL_TEST_HARNESS=1 node tests/e2e/test_audit_stress.cjs
 
       - name: Cooldown tamper (destructive)
         run: WL_TEST_HARNESS=1 node tests/e2e/test_cooldown_tamper.cjs

tests/e2e/setup_test_env.sh

@@ -137,24 +137,35 @@ echo "--- Seeding limit config (enable analyst create paths + approval routing)
 # The default _limit_config.json has every analyst-creation toggle = False
 # (see DEFAULT_LIMITS in bin/wl_constants.py). E2E tests that exercise the
 # analyst -> approval-queue flow (e.g. LC01/LC02 in
-# test_control_panel_long_content.cjs) need:
+# test_control_panel_long_content.cjs, test_concurrent_approval_race.cjs)
+# need:
 #
 #   allow_analyst_create_rules   -> true  | gate-pass at wl_handler.py L2835
 #   allow_analyst_create_csv     -> true  | gate-pass at wl_handler.py L2771
-#   require_reason_rule_creation -> true  | route to approval queue (returns request_id)
-#   require_reason_csv_creation  -> true  | same for CSV
+#   allow_analyst_delete_rules   -> true  | gate-pass at wl_handler.py L3000
+#   allow_analyst_delete_csv     -> true  | gate-pass at wl_handler.py L2888
+#   require_reason_rule_creation -> true  | route create_rule to queue (returns request_id)
+#   require_reason_csv_creation  -> true  | route create_csv to queue
+#   require_reason_rule_deletion -> true  | route remove_rule to queue (returns request_id)
+#   require_reason_csv_deletion  -> true  | route remove_csv to queue
 #
-# Admin paths bypass these gates at L2747 (create_csv) and L2811
-# (create_rule) -- admins execute directly. So setting these toggles is
-# safe for admin-running tests and necessary for analyst-running tests.
+# Admin paths bypass these gates -- admins execute directly. So setting
+# these toggles is safe for admin-running tests and necessary for
+# analyst-running tests. The deletion toggles were added 2026-05-22
+# after E2E Full nightly went red on test_concurrent_approval_race.cjs:
+# the test submits action=remove_rule as an analyst and was blocked by
+# allow_analyst_delete_rules=false (the default), failing 2 of 4
+# sub-tests with "Removing detection rules is not permitted." Adding
+# the same shape of seeding the Phase 0.3.1 fix used for the creation
+# toggles.
 #
 # Use the production REST action set_daily_limits (superadmin-only per
 # SUPERADMIN_ROLES at wl_handler.py L1395). This is environment
 # provisioning, not synthetic-fixture injection -- the production code
 # path computes the HMAC signature and writes the config atomically.
 # Per CLAUDE.md "Synthetic Fixtures -- Banned" this is the allowed
 # pattern (exercise the real production endpoint).
-CFG_PAYLOAD='{"action":"set_daily_limits","limits":{"allow_analyst_create_rules":true,"allow_analyst_create_csv":true,"require_reason_rule_creation":true,"require_reason_csv_creation":true}}'
+CFG_PAYLOAD='{"action":"set_daily_limits","limits":{"allow_analyst_create_rules":true,"allow_analyst_create_csv":true,"allow_analyst_delete_rules":true,"allow_analyst_delete_csv":true,"require_reason_rule_creation":true,"require_reason_csv_creation":true,"require_reason_rule_deletion":true,"require_reason_csv_deletion":true}}'
 cfg_status=$(MSYS_NO_PATHCONV=1 docker exec "$CONTAINER" \
     curl -sk -o /dev/null -w "%{http_code}" \
     -u "superadmin1:$ADMIN_PASS" \