fix(tests): make crypto tests hermetic with a self-supplied Fernet key

test_crypto's round-trip tests called the real encrypt/decrypt path, which needs settings.encryption_key configured — so they silently depended on ROBOCO_ENCRYPTION_KEY being present in the environment. In agent gate containers it is not, so four tests failed there and the agent mis-read it as a code regression. An autouse fixture now monkeypatches a valid generated Fernet key, so the tests pass without any ambient secret and agents never need the production key injected to gate.

tests/unit/utils/test_crypto.py

@@ -5,6 +5,8 @@ from __future__ import annotations
 from unittest.mock import patch
 
 import pytest
+from cryptography.fernet import Fernet
+from roboco.config import settings
 from roboco.utils.crypto import (
     EncryptionError,
     _get_fernet,
@@ -14,6 +16,19 @@ from roboco.utils.crypto import (
 )
 
 
+@pytest.fixture(autouse=True)
+def _configured_encryption_key(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Supply a valid Fernet key for the tests that exercise real crypto.
+
+    The round-trip tests need a configured key; without this they depend on
+    ``ROBOCO_ENCRYPTION_KEY`` being set in the environment — it is not in agent
+    gate containers, which is exactly why they failed there. The patch-based
+    tests below replace ``settings`` wholesale inside their ``with`` blocks, so
+    this autouse default never interferes with them.
+    """
+    monkeypatch.setattr(settings, "encryption_key", Fernet.generate_key().decode())
+
+
 def test_encrypt_decrypt_round_trip() -> None:
     plaintext = "sk-secret-test-token-12345"
     encrypted = encrypt_token(plaintext)