fix(e2e): tolerate conductor-oss's read-only secret store; harden mcp-testkit preflight

conductor-oss's standalone server serves secrets from the process env, so
PUT/DELETE /api/secrets/* return 500 "env-backed secrets are read-only".
This never surfaced while e2e ran against the writable agentspan server;
switching to conductor-oss exposed it as 4 CI failures (suite2, suite4,
suite26). Mirrors the assumption-skip already shipped in the Java/C# ports:
CredentialsCLI.set() and test_suite26's _put_secret() skip (not fail) on a
"read-only" response body; CredentialsCLI.delete() additionally tolerates
"read-only" as best-effort cleanup, same as it already does for "not found".

Also widens test_suite5's mcp-testkit --help preflight from a 5s timeout
that only caught FileNotFoundError to 15s + catching TimeoutExpired too —
a separate, likely-environmental flake surfaced in the same CI run.

Author: Kowser

e2e/conftest.py

@@ -110,14 +110,23 @@ def _run(self, *args: str) -> subprocess.CompletedProcess:
 
     def set(self, name: str, value: str) -> None:
         result = self._run("credentials", "set", name, value)
-        assert result.returncode == 0, (
-            f"credentials set {name} failed: {result.stderr}"
-        )
+        if result.returncode != 0:
+            # conductor-oss standalone serves secrets from the server process
+            # env — the store is read-only there, so the write-dependent
+            # lifecycle steps cannot run (a server-flavor capability, not an
+            # SDK regression; mirrors the Java/C# ports' assumption-skip).
+            if "read-only" in result.stderr.lower():
+                pytest.skip(
+                    "server secret store is read-only (env-backed) — "
+                    "skipping write-dependent step"
+                )
+            raise AssertionError(f"credentials set {name} failed: {result.stderr}")
 
     def delete(self, name: str) -> None:
         result = self._run("credentials", "delete", name)
-        # Ignore "not found" errors during cleanup
-        if result.returncode != 0 and "not found" not in result.stderr.lower():
+        # Ignore "not found" and "read-only" errors during cleanup — best-effort
+        stderr = result.stderr.lower()
+        if result.returncode != 0 and "not found" not in stderr and "read-only" not in stderr:
             raise AssertionError(
                 f"credentials delete {name} failed: {result.stderr}"
             )

e2e/test_suite26_worker_credentials.py

@@ -89,7 +89,17 @@ def _put_secret(name: str, value: str) -> None:
         headers={"Content-Type": "text/plain"},
         timeout=10,
     )
-    r.raise_for_status()
+    if not r.ok:
+        # conductor-oss standalone serves secrets from the server process
+        # env — the store is read-only there, so the write-dependent
+        # lifecycle steps cannot run (a server-flavor capability, not an
+        # SDK regression; mirrors the Java/C# ports' assumption-skip).
+        if "read-only" in r.text.lower():
+            pytest.skip(
+                "server secret store is read-only (env-backed) — "
+                "skipping write-dependent step"
+            )
+        r.raise_for_status()
 
 
 def _delete_secret(name: str) -> None:

e2e/test_suite5_http_tools.py

@@ -457,11 +457,12 @@ def test_http_lifecycle(self, runtime, cli_credentials, model):
                 ["mcp-testkit", "--help"],
                 capture_output=True,
                 text=True,
-                timeout=5,
+                timeout=15,
             )
-        except FileNotFoundError:
+        except (FileNotFoundError, subprocess.TimeoutExpired):
             pytest.skip(
-                "mcp-testkit not installed — required for Suite 5 HTTP tools test"
+                "mcp-testkit not installed or unresponsive — required for "
+                "Suite 5 HTTP tools test"
             )
 
         server_proc = None