test(install): make github probe unit tests hermetic (mock requests.get) (#2038)

* chore: release v0.24.0

Bump pyproject.toml and uv.lock to 0.24.0 and move the [Unreleased]
CHANGELOG block to [0.24.0] - 2026-07-05 (one so-what entry per merged PR).
MINOR bump: new `apm config list` alias (#1991) and Antigravity `trigger: glob`
frontmatter support (#1984); no BREAKING changes. Lint mirror green locally
(ruff check + format, pylint R0801, auth-signals).

Post-merge: tag v0.24.0 to trigger the release workflow.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(install): treat throttled GitHub probe as indeterminate, not inaccessible

The pre-flight accessibility probe treated a rate-limited 403/429 (primary
60/hr or secondary concurrency limit) as 'package not accessible' and aborted
the install -- a false negative, since a throttled response is no evidence the
repo is missing. On single-IP runners that concentrate many public-package
installs (the consolidated macOS release job), this made the release/nightly
integration suite flake red for days.

Detect a genuine rate-limit response (403 + X-RateLimit-Remaining: 0, or
403/429 + Retry-After) and let the install proceed so the download step becomes
the source of truth. Genuine 404s and permission 403s still fail closed. Adds
unit coverage for the helpers and the allow-through / fail-closed end-to-end
paths. Lint mirror green.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* chore: spec-conformance waiver for rate-limit probe hardening

apm-spec-waiver: robustness bugfix -- throttled GitHub probe no longer false-negatives a public package; existing install existence-validation contract is unchanged (no new normative behaviour)

* test(install): make github probe unit tests hermetic (mock requests.get)

test_verbose_validation_failure_calls_build_error_context and
test_github_host_skips_ssh_attempt mocked urllib.request.urlopen, but the
validator uses requests.get -- so they made a real network call to
api.github.com/repos/owner/repo and only passed because it returned 404.
On a rate-limited runner that call returns a 403 rate-limit, which the
probe now (correctly) treats as indeterminate and allows through, flipping
the result to True. Mock requests.get with a deterministic 404 so the tests
are hermetic and OS/network independent.

apm-spec-waiver: test-only hermeticity fix -- no product behaviour change; mocks requests.get instead of the dead urllib path.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: danielmeppiel <danielmeppiel@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: danielmeppiel

tests/unit/test_install_command.py

@@ -474,18 +474,10 @@ def test_subdir_with_ref_failure_verbose_omits_probe_log_hint(self, mock_validat
         "apm_cli.core.token_manager.GitHubTokenManager.resolve_credential_from_git",
         return_value=None,
     )
-    @patch("urllib.request.urlopen")
-    def test_verbose_validation_failure_calls_build_error_context(self, mock_urlopen, _mock_cred):
+    @patch("apm_cli.install.validation.requests.get")
+    def test_verbose_validation_failure_calls_build_error_context(self, mock_get, _mock_cred):
         """When GitHub validation fails in verbose mode, build_error_context should be invoked."""
-        import urllib.error
-
-        mock_urlopen.side_effect = urllib.error.HTTPError(
-            url="https://api.github.com/repos/owner/repo",
-            code=404,
-            msg="Not Found",
-            hdrs={},
-            fp=None,
-        )
+        mock_get.return_value = MagicMock(ok=False, status_code=404, reason="Not Found", headers={})
 
         with patch.object(
             __import__("apm_cli.core.auth", fromlist=["AuthResolver"]).AuthResolver,
@@ -1194,18 +1186,11 @@ def test_explicit_http_generic_host_tries_http_first(self, mock_run):
     def test_github_host_skips_ssh_attempt(self, mock_run):
         """GitHub.com repositories do NOT go through the SSH-first ls-remote path."""
 
-        import urllib.error
-        import urllib.request
-
         from apm_cli.commands.install import _validate_package_exists
 
-        with patch("urllib.request.urlopen") as mock_urlopen:
-            mock_urlopen.side_effect = urllib.error.HTTPError(
-                url="https://api.github.com/repos/owner/repo",
-                code=404,
-                msg="Not Found",
-                hdrs={},
-                fp=None,
+        with patch("apm_cli.install.validation.requests.get") as mock_get:
+            mock_get.return_value = MagicMock(
+                ok=False, status_code=404, reason="Not Found", headers={}
             )
             result = _validate_package_exists("owner/repo", verbose=False)