#501 test(examples): restore the hard audit-sink standalone guarantee; cover the tutorial without installing it

[Anonymous]

Originally created by: fu351

PR [#499] added examples/plugin-audit-sink/ (a tutorial doberman.audit_sinks plugin) and, in core proper, loosened the standalone guarantee test test_no_audit_sinks_registered_by_default from a hard assert discover_audit_sinks() == [] to a filter excluding any sink whose module starts with "example_". That loosening was unnecessary: default CI never installs the tutorial package (testpaths = ["tests", "tools"]), so discover_audit_sinks() is always empty in CI regardless. The comment claimed the change "mirrors the rules check above," but test_default_plugin_registry_has_no_enterprise_plugins is still a hard == [] — so the audit-sink guarantee was the only one weakened. examples/plugin-guardrail already has a CI-visible test (tests/unit/test_examples_plugin_guardrail.py) that covers its tutorial via a sys.path import, never installing it into the active environment — this PR gives plugin-audit-sink the same treatment.

• Restore test_no_audit_sinks_registered_by_default to the hard assert discover_audit_sinks() == [].
• Add tests/unit/test_examples_plugin_audit_sink.py, modelled on test_examples_plugin_guardrail.py: package layout, the doberman.audit_sinks entry-point declaration, ExampleAuditSink satisfying the AuditSink protocol, emit() never raising (including on a malformed/empty record), a failure-path log check that a secret placed in the record never leaks into the WARNING log line, and a check that the sys.path import itself does not register the entry point (discover_audit_sinks() stays []).
• Update examples/plugin-audit-sink/README.md's CI note to name the new test instead of the vague, previously-false claim that core "only imports the sink class directly for emit/never-raises checks."

Follow-up to [#499].

🤖 Generated with Claude Code

[Anonymous]

Ticket changed by: fu351

• status: open --> closed