update to cmem-plugin-template v9.6.1 and fix red test suite

[seebi]

Updates this repository to cmem-plugin-template v9.6.1 via copier update, refreshes the locked dependencies that come with it, and fixes the red test suite.

Template update

• Two warning messages ran together without a space (…access to.Those files…); corrected while resolving ISC004.

This request was originally raised against v9.5.0; a second commit moves it to v9.6.1, which restores the [tool.pytest.ini_options] table. Without it pytest's rootdir walk escapes the project directory, so pytest-dotenv stops finding .env and the Corporate Memory integration tests run unconfigured.

Test suite fixes

The suite was fully red, from three independent causes. An earlier note on this request blamed missing Docker or service credentials — that was wrong, and is corrected here.

1. The test container could no longer be built. Debian 11 reached end of life and its packages were removed from deb.debian.org/debian-security, so apt-get exited 100 on systemd, libexpat1 and systemd-timesyncd. This is what CI has been failing on. The container moves to debian:trixie-slim, which also pre-creates /var/run/sshd, hence the mkdir -p.

Verified against OpenSSH 10.0p2 that everything the tests rely on still holds: RSA, ed25519-with-passphrase and password authentication, plus the three deliberately unreadable fixtures (/etc/sudoers, /etc/restricted.txt, /restricted). RSA continues to work via rsa-sha2-512/256.

2. Ryuk could not start on Docker Desktop. The testcontainers reaper bind-mounts the Docker socket, which Docker Desktop refuses for its per-user socket path, so every test errored before the container was reached. The fixtures already close their own containers, so the reaper is redundant here and is now disabled by default in conftest.py. setdefault keeps an explicit override working. This affected local runs only; CI uses a standard socket.

3. A real defect in the plugin, not in the tests. test_plugin_wrong_username failed with SSHException: No existing session instead of AuthenticationException. All ten ssh_client.connect() call sites left paramiko's allow_agent and look_for_keys at their True defaults, so the plugin offered the host's SSH agent keys and ~/.ssh private keys to the remote server before the key the task was configured with:

defaults (agent + look_for_keys ON):    SSHException: No existing session
allow_agent=False, look_for_keys=False: AuthenticationException: Authentication failed.

Running inside Corporate Memory this means a task offers the deployment host's private keys to whatever remote server it points at, and may authenticate with credentials it was never configured with. It also exhausts sshd's MaxAuthTries, which is why the server disconnects mid-handshake and the error degrades. Fixed at all ten call sites, with a ### Fixed changelog entry.

This passes in CI regardless, because CI has no SSH agent — only the container build failure was visible there.

Verification

task check passes end to end locally: ruff, mypy (22 source files), deptry, trivy and 36 passed.

Follow-up, not addressed here

The same MaxAuthTries dynamic means a user whose configured key is rejected by a server with a low limit can still see No existing session rather than a readable authentication error. Worth translating that disconnect into a proper message if the UI text should be reliable.

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
init.py	0	0	100%
autocompletion.py	77	6	92%	42-43 48 94-95 172
download.py	114	10	91%	211-213 235-236 261 378 391-393
execute_commands.py	124	12	90%	46 49 216-218 345-347 352 355-357
list.py	68	0	100%
retrieval.py	99	6	94%	64 86 136 146-147 169
upload.py	83	7	92%	141-143 191 202-203 208
utils.py	61	3	95%	43 63 74
TOTAL	626	44	93%

Tests	Skipped	Failures	Errors	Time
36	0 💤	0 ❌	0 🔥	90.502 ⏱