Keep reliability checks tied to workflows and selected tools

Require the existing troubleshooting jobs and their destinations without
making additional help entries break unrelated safety checks. Keep the
opening backup warning scoped to its actual entry point.

Run closed service and middleware models through the containing fixture's
selected Python interpreter without site startup. Retain every safety
scenario and deadline while qualifying the pending maintenance source.

Refs #2888

Contract-Neutral: Test-only navigation assertions and confined model interpreter selection. Production behavior and safety deadlines are unchanged.

scripts/installtests/agent_truenas_teardown.py

@@ -11,6 +11,7 @@ from pathlib import Path
 import shlex
 import stat
 import subprocess
+import sys
 import tempfile
 import unittest
 
@@ -147,8 +148,16 @@ class AgentTrueNASTeardown(unittest.TestCase):
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
             tools = root / "tools"; tools.mkdir()
+            models = root / "models"; models.mkdir()
             for name in ("midclt", "ps", "systemctl"):
-                file = tools / name; file.write_text(MODEL); file.chmod(0o700)
+                model = models / name; model.write_text(MODEL)
+                # These closed stdlib models share the interpreter selected by
+                # the containing suite. The host's /usr/bin/python3 may differ
+                # and pays its site startup cost on every observed operation.
+                file = tools / name
+                file.write_text("#!/bin/sh\nexec " + shlex.quote(sys.executable)
+                                + " -I -S " + shlex.quote(str(model)) + ' "$@"\n')
+                file.chmod(0o700)
             if fault == "missing-midclt": (tools / "midclt").unlink()
             for name in ("state", "helper", "profile", "unit"):
                 directory = root / name; directory.mkdir(mode=0o700)

scripts/tests/test_auto_update_service_state.py

@@ -10,6 +10,7 @@ import json
 import os
 from pathlib import Path
 import shutil
+import shlex
 import subprocess
 import sys
 import tempfile
@@ -180,7 +181,13 @@ class UpdaterFixture(unittest.TestCase):
             f = Path(directory)
             for name in ("tools", "tmp", "install/bin", "config"):
                 (f / name).mkdir(parents=True)
-            (f / "tools/systemctl").write_text(MANAGER)
+            (f / "manager.py").write_text(MANAGER)
+            # Use the suite's selected interpreter, without site startup, for
+            # this stdlib-only model. Re-resolving python3 for every manager
+            # observation can select a different, slower host installation.
+            (f / "tools/systemctl").write_text(
+                "#!/bin/sh\nexec " + shlex.quote(sys.executable) + " -I -S "
+                + shlex.quote(str(f / "manager.py")) + ' "$@"\n')
             (f / "tools/systemctl").chmod(0o755)
             # The production log() remains intact in real-log controls. Only
             # its external sink is confined; no host journal is contacted.