test: fix vacuous assertion and incomplete serialization test in upload safeoutputs (#857)

test_default_container_folder_has_hash_suffix. The assertion compared a
  pure local function to itself (same arguments, same deterministic body) so
  it could never fail regardless of what the function returned. Determinism

- upload_workitem_attachment: add missing comment-field assertion in
  test_result_serializes_correctly. The test constructed params with
  comment: Some("Test attachment") but never asserted the field appeared
  in the serialized JSON, meaning a regression that dropped comment from
  the serialized output would silently pass.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

src/safeoutputs/upload_pipeline_artifact.rs

@@ -1065,12 +1065,6 @@ name-prefix: "ci-"
         assert_ne!(a, b, "different content must produce different folders");
         // Determinism: same inputs yield same folder.
         assert_eq!(a, folder_for("TriageSummary", b"content-alpha"));
-        // Identical content → same folder regardless of call order (idempotent).
-        assert_eq!(
-            folder_for("TriageSummary", b"same-content"),
-            folder_for("TriageSummary", b"same-content"),
-            "same content must always map to the same folder"
-        );
     }
 
     /// When `require-unique-names` is set, the executor uses the clean folder

src/safeoutputs/upload_workitem_attachment.rs

@@ -556,6 +556,7 @@ mod tests {
         assert!(json.contains(r#""name":"upload-workitem-attachment""#));
         assert!(json.contains(r#""work_item_id":42"#));
         assert!(json.contains(r#""file_path":"output/report.pdf""#));
+        assert!(json.contains(r#""comment":"Test attachment""#));
     }
 
     #[test]