test: gate atomic pty snapshot rejection in CI

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f

Author: schickling-assistant

flake.nix

@@ -123,6 +123,19 @@
           };
         };
 
+        # Narrow sandbox-safe integration gate for the atomic snapshot boundary. The main package
+        # deliberately omits the broad doctor suite because some doctor cases exercise facilities
+        # unavailable in the Nix sandbox; this derivation executes the one hermetic regression by
+        # its unique test name so it cannot be present-but-invisible to CI.
+        st2AtomicPtySnapshot = st2.overrideAttrs (_: {
+          pname = "st2-atomic-pty-snapshot-check";
+          cargoTestFlags = [
+            "--test"
+            "doctor"
+            "doctor_rejects_a_partial_pty_snapshot_atomically"
+          ];
+        });
+
         hookSuccessorSource = pkgs.runCommand "st2-hook-successor-source" { } ''
           cp -R ${self} $out
           chmod -R u+w $out
@@ -155,6 +168,7 @@
         # commits on every rebase. The devShell ships rustfmt + clippy for whoever
         # wants them.
         checks.st2 = st2;
+        checks.atomic-pty-snapshot = st2AtomicPtySnapshot;
 
         # Real producer-consumer contract: st2 consumes `pty list --json` from the exact pty
         # revision that owns fleet observation. Fake CLI fixtures below still cover malformed