Resolve SonarCloud PR-17 findings

- S2583 (test_pdf_download / test_pipeline concurrency tests): the
  'condition always false' on 'assert 1 <= peak <= 3' was a static-analysis
  false positive — Sonar can't see that 'peak' (a nonlocal int) is mutated by
  the monkeypatched async double via download_pdfs/enrich_collection's gather.
  Switch the counter to a dict so the mutation isn't const-propagated to 0;
  same fix applied to the enrich test pre-emptively.
- S7503 (test_cli min-citations test): the fake_run_search / fake_shutdown
  doubles replace awaited production fns and must stay async — mark NOSONAR.

Author: JE-Chen

tests/test_cli.py

@@ -325,11 +325,11 @@ def test_cli_min_citations_flows_into_query(tmp_path, monkeypatch, sample_papers
     previously unreachable from the CLI)."""
     captured: dict[str, Query] = {}
 
-    async def fake_run_search(query: Query, **_kwargs) -> PaperCollection:
+    async def fake_run_search(query: Query, **_kwargs) -> PaperCollection:  # NOSONAR async stub
         captured["query"] = query
         return PaperCollection(query=query, papers=tuple(sample_papers))
 
-    async def fake_shutdown() -> None:
+    async def fake_shutdown() -> None:  # NOSONAR async stub
         return None
 
     monkeypatch.setattr(cli_module, "run_search", fake_run_search)

tests/test_pdf_download.py

@@ -347,15 +347,15 @@ async def test_download_pdfs_caps_concurrency(tmp_path: Path, monkeypatch):
     hammer a single publisher CDN with one request per paper at once."""
     import asyncio
 
-    active = 0
-    peak = 0
+    # dict (not nonlocal ints) so the counter mutation is visible to static
+    # analysers that don't trace the monkeypatched async call path.
+    counters = {"active": 0, "peak": 0}
 
     async def fake_download_one(paper, pdf_dir):
-        nonlocal active, peak
-        active += 1
-        peak = max(peak, active)
+        counters["active"] += 1
+        counters["peak"] = max(counters["peak"], counters["active"])
         await asyncio.sleep(0.01)
-        active -= 1
+        counters["active"] -= 1
         return pdf_download_module.PdfDownloadResult(
             paper_key=paper.source_id, path=None, skipped_reason=None
         )
@@ -364,4 +364,4 @@ async def fake_download_one(paper, pdf_dir):
     papers = [_paper(source_id=str(i), pdf_url="https://e/p.pdf") for i in range(8)]
     results = await download_pdfs(_collection(*papers), tmp_path, concurrency=3)
     assert len(results) == 8
-    assert 1 <= peak <= 3  # never more than the cap in flight at once
+    assert 1 <= counters["peak"] <= 3  # never more than the cap in flight at once

tests/test_pipeline.py

@@ -326,15 +326,15 @@ async def test_enrich_collection_caps_concurrency(monkeypatch):
 
     from thesisagents.core.models import PaperCollection
 
-    active = 0
-    peak = 0
+    # dict (not nonlocal ints) so the counter mutation is visible to static
+    # analysers that don't trace the monkeypatched async call path.
+    counters = {"active": 0, "peak": 0}
 
     async def fake_enrich_one(paper, *, language, model):
-        nonlocal active, peak
-        active += 1
-        peak = max(peak, active)
+        counters["active"] += 1
+        counters["peak"] = max(counters["peak"], counters["active"])
         await asyncio.sleep(0.01)
-        active -= 1
+        counters["active"] -= 1
         return paper
 
     monkeypatch.setattr(pipeline_module, "_enrich_one", fake_enrich_one)
@@ -345,4 +345,4 @@ async def fake_enrich_one(paper, *, language, model):
     )
     out = await pipeline_module.enrich_collection(collection, concurrency=3)
     assert len(out.papers) == 8
-    assert 1 <= peak <= 3  # never more than the cap in flight at once
+    assert 1 <= counters["peak"] <= 3  # never more than the cap in flight at once