fix(tests): clear two test failures (one pre-existing, one bumped by #2044)

1. test_issue1362_codex_oauth_onboarding.py::test_anthropic_onboarding_setup_allows_linked_oauth_without_api_key
   Pre-existing env-collision bug, surfaced when HERMES_WEBUI_SKIP_ONBOARDING=1
   is in the test runner env (set by hosting providers and by isolated test
   harnesses). `apply_onboarding_setup()` short-circuits without writing the
   config file when SKIP_ONBOARDING is set, but the test asserts the file was
   written, so it fails with FileNotFoundError on read_text().
   Fix: `monkeypatch.delenv("HERMES_WEBUI_SKIP_ONBOARDING", raising=False)` —
   matches the convention already used in test_issue1499_keyless_onboarding.py
   and test_issue1500_lmstudio_env_var_alignment.py.

2. test_issue1800_file_html_interactions.py::test_media_html_inline_keeps_csp_sandbox
   Slicing-based source-string assertion (4000-char window after `def _handle_media`)
   broke because PR #2044's MEDIA_ALLOWED_ROOTS parsing was inserted earlier in
   the function and pushed the CSP block to offset 4211. Widened window to 5000.
   Assertion content is structural (CSP sandbox string present), not positional.

CHANGELOG.md

@@ -22,7 +22,7 @@
 
 ### Tests
 
-5108 → **5131 passing, 0 regressions** (+23 across new test files for session-recovery-API HTTP-shape contracts, state.db sidecar reconciliation including the round-trip schema-parity guard and the per-pid tmp-suffix guard, and the MEDIA_ALLOWED_ROOTS static reference).
+5108 → **5120 passing, 8 skipped, 1 xfailed, 2 xpassed, 0 regressions** (+12 net passing across new test files for session-recovery-API HTTP-shape contracts, state.db sidecar reconciliation including the round-trip schema-parity guard and the per-pid tmp-suffix guard, and the MEDIA_ALLOWED_ROOTS static reference). Full suite ~161s on Python 3.11 with `HERMES_HOME` isolation.
 
 ### Notes
 

tests/test_issue1362_codex_oauth_onboarding.py

@@ -554,6 +554,13 @@ def test_runtime_provider_reads_use_anthropic_env_lock():
 def test_anthropic_onboarding_setup_allows_linked_oauth_without_api_key(monkeypatch, tmp_path):
     import api.onboarding as onboarding
 
+    # apply_onboarding_setup() short-circuits when HERMES_WEBUI_SKIP_ONBOARDING
+    # is set in the environment (hosting providers like Agent37 use it to ship
+    # a pre-configured WebUI). Local test runs may also set it for the same
+    # reason. The test exercises the file-writing branch, so delete the var
+    # for the test's scope. monkeypatch.delenv is a no-op if the var is unset.
+    monkeypatch.delenv("HERMES_WEBUI_SKIP_ONBOARDING", raising=False)
+
     cfg_path = tmp_path / "config.yaml"
     home = tmp_path / "home"
     home.mkdir()

tests/test_issue1800_file_html_interactions.py

@@ -68,7 +68,10 @@ def test_html_media_open_full_uses_inline_new_tab_not_download():
 
 def test_media_html_inline_keeps_csp_sandbox():
     """api/media may serve HTML inline only behind a CSP sandbox."""
-    body = _slice_after(ROUTES_PY, "def _handle_media", 4000)
+    # Slice widened to 5000 (was 4000) after PR #2044 added MEDIA_ALLOWED_ROOTS
+    # parsing earlier in _handle_media, which pushed the CSP block past the
+    # original window. The assertion is structural, not positional.
+    body = _slice_after(ROUTES_PY, "def _handle_media", 5000)
     assert 'html_inline_ok = inline_preview and mime == "text/html"' in body
     assert 'csp = "sandbox allow-scripts" if html_inline_ok else None' in body
     assert "csp=csp" in body