fix: keep isolated backend tests hermetic and disk-backed

core/archipelago/src/api/rpc/container.rs

@@ -257,6 +257,12 @@ impl RpcHandler {
             }
         }
 
+        // Unit tests deliberately construct a handler without an orchestrator.
+        // Never let that mock cross into a real Podman command on the host.
+        if cfg!(test) && self.orchestrator.is_none() {
+            return Ok(serde_json::json!([]));
+        }
+
         let output = tokio::process::Command::new("podman")
             .args(["ps", "-a", "--format", "json"])
             .output()

core/archipelago/src/api/rpc/package/runtime.rs

@@ -1979,9 +1979,9 @@ pub(super) fn manifest_apps_dirs() -> Vec<std::path::PathBuf> {
     if let Some(root) = std::env::var_os("ARCHIPELAGO_APPS_DIR") {
         dirs.push(root.into());
     }
-    if let Ok(manifest_dir) = std::env::var("CARGO_MANIFEST_DIR") {
-        dirs.push(Path::new(&manifest_dir).join("../../apps"));
-    }
+    // Cargo exposes this at compile time, not when an already-built isolated
+    // test executable is launched from a different working directory.
+    dirs.push(Path::new(env!("CARGO_MANIFEST_DIR")).join("../../apps"));
     dirs.extend([
         Path::new("apps").to_path_buf(),
         Path::new("/opt/archipelago/apps").to_path_buf(),

core/archipelago/src/appgate/identity.rs

@@ -119,9 +119,9 @@ fn apps_dirs() -> Vec<PathBuf> {
     if let Some(root) = std::env::var_os("ARCHIPELAGO_APPS_DIR") {
         dirs.push(root.into());
     }
-    if let Ok(manifest_dir) = std::env::var("CARGO_MANIFEST_DIR") {
-        dirs.push(PathBuf::from(manifest_dir).join("../../apps"));
-    }
+    // Preserve source discovery after the prebuilt test binary moves into its
+    // networkless execution container.
+    dirs.push(PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../apps"));
     dirs.extend([
         PathBuf::from("apps"),
         PathBuf::from("/opt/archipelago/apps"),