fix: skip feature service tests and require all tests to pass (#1160)

The two feature service tests require a Red Hat mTLS certificate and
access to feature.stage.api.redhat.com, which are only available in
the ephemeral CI environment. Skip them in pulp-test.

Also: the agent must now treat ANY test failure as a workflow failure.
No proceeding to commit with failing tests.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dkliban

.alcove/agents/upgrade-deps/AGENT.md

@@ -268,7 +268,9 @@ This runs:
 5. pulp_npm tests (test_pull_through_install)
 6. pulp_service functional tests
 
-If tests fail:
+Note: two feature service tests (`test_forbidden_feature_service`, `test_entitled_feature_service`) are excluded because they require a Red Hat mTLS certificate and access to `feature.stage.api.redhat.com`, which are not available in the dev container.
+
+ALL tests MUST pass. If any test fails, the workflow is NOT complete. Do NOT proceed to Phase 7 with failing tests. Instead:
 - Analyze the failure to determine if it's caused by a patch, by `pulp_service/` code, or by an upstream API change
 - Fix the patch or code accordingly (edit files on /workspace — they're shared)
 - Restart services if needed and re-run the failing tests with `pulp-test --pyargs {test_spec}`

dev-container/scripts/pulp-test

@@ -121,7 +121,10 @@ run_tests() {
 
     echo "--- Test 6/6: pulp_service functional ---"
     pytest -v -r sx --color=yes --pyargs pulp_service.tests.functional \
-        -m 'not parallel' || FAILED=$((FAILED + 1))
+        -m 'not parallel' \
+        --deselect pulp_service/tests/functional/test_feature_service.py::test_forbidden_feature_service \
+        --deselect pulp_service/tests/functional/test_feature_service.py::test_entitled_feature_service \
+        || FAILED=$((FAILED + 1))
 
     echo "=== Results: $((6 - FAILED))/6 test suites passed ==="
     [ "$FAILED" -eq 0 ]