fix(test): make Arch CI isolation and platform assertions pass

Use read mocks when running as root (chmod 000 is ineffective), stop
short-circuiting Get-TestRepoRoot via GITHUB_WORKSPACE, accept pacman in
install-hint fallbacks, and tolerate empty PATH as null on Unix.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bolens

profile.d/utilities-modules/system/utilities-env.ps1

@@ -303,7 +303,9 @@ function Remove-Path {
         Set-EnvVar -Name 'PATH' -Value $newPath -Global
     }
     else {
-        $env:PATH = $newPath
+        # Prefer empty string over $null so consumers comparing to '' stay consistent;
+        # on Unix, assigning '' may still clear the process env entry.
+        $env:PATH = if ($null -eq $newPath) { '' } else { $newPath }
     }
 }
 

tests/TestSupport/TestPaths.ps1

@@ -7,12 +7,16 @@
 .SYNOPSIS
     Locates the repository root directory for the tests.
 .DESCRIPTION
-    Prefers GITHUB_WORKSPACE / PS_PROFILE_REPO_ROOT when they point at this repo,
-    then walks up from the supplied start path until it finds a .git entry or the
-    profile markers (archive checkouts without .git).
+    Prefers an explicit PS_PROFILE_REPO_ROOT when set, then walks up from the
+    supplied start path until it finds a .git entry or the profile markers
+    (archive checkouts without .git).
 
     Marker logic is inlined so this function stays self-contained after promotion
     to Function:\global:Get-TestRepoRoot (Pester containers).
+
+    GITHUB_WORKSPACE is intentionally not used as a short-circuit: CI always sets
+    it, which would make isolation tests that start outside the repo succeed
+    incorrectly.
 .PARAMETER StartPath
     The path to begin searching from; defaults to the calling script root.
 .OUTPUTS
@@ -40,11 +44,9 @@ function Get-TestRepoRoot {
         return (Test-Path -LiteralPath $profileScript) -and (Test-Path -LiteralPath $profileDir)
     }
 
-    foreach ($envName in @('PS_PROFILE_REPO_ROOT', 'GITHUB_WORKSPACE')) {
-        $candidate = [Environment]::GetEnvironmentVariable($envName)
-        if ($candidate -and (Test-RepoRootMarkerLocal -Path $candidate)) {
-            return ([System.IO.Path]::GetFullPath($candidate))
-        }
+    $explicitRoot = [Environment]::GetEnvironmentVariable('PS_PROFILE_REPO_ROOT')
+    if ($explicitRoot -and (Test-RepoRootMarkerLocal -Path $explicitRoot)) {
+        return ([System.IO.Path]::GetFullPath($explicitRoot))
     }
 
     $current = Get-Item -LiteralPath $StartPath

tests/integration/bootstrap/preference-aware-install-hints-fallback.tests.ps1

@@ -151,7 +151,7 @@ Describe 'Preference-Aware Install Hints - Integration Tests (Fallback Chains)'
             $result = Get-PreferenceAwareInstallHint -ToolName 'generic-tool-xyz' -ToolType 'generic'
             $result | Should -Not -BeNullOrEmpty
             # Should suggest system package manager
-            $result | Should -Match 'scoop|brew|apt|winget|choco'
+            $result | Should -Match 'scoop|brew|apt|winget|choco|pacman|yum|dnf'
         }
 
         It 'Falls back from tool-specific to language-specific to system' {

tests/integration/system/environment-variables.tests.ps1

@@ -95,7 +95,8 @@ Describe 'Environment Variables Integration Tests' {
             $originalPath = $env:PATH
                         $env:PATH = 'C:\SinglePath'
             Remove-Path -Path 'C:\SinglePath'
-            $env:PATH | Should -Be ''
+            # Unix PowerShell clears the variable when assigned ''; Windows keeps ''.
+            ($null -eq $env:PATH -or $env:PATH -eq '') | Should -Be $true
             }
             finally {
                 $env:PATH = $originalPath

tests/unit/library/fragment/library-fragment-loading-extended.tests.ps1

@@ -41,19 +41,32 @@ function script:Get-FragmentTierResult {
 function script:Simulate-UnreadableFragmentFile {
     <#
     .SYNOPSIS
-        Make a fragment unreadable for parse-failure tests (chmod on Unix; module Mock on Windows).
+        Make a fragment unreadable for parse-failure tests (chmod on Unix; module Mock on Windows/root).
     #>
     param(
         [Parameter(Mandatory)]
         [string]$Path
     )
 
+    $runningAsRoot = $false
     if ($IsLinux -or $IsMacOS) {
+        try {
+            $uid = & id -u 2>$null
+            $runningAsRoot = ($uid -eq '0')
+        }
+        catch {
+            $runningAsRoot = $false
+        }
+    }
+
+    # Non-root Unix: chmod 000 blocks reads. Root (e.g. Arch CI containers) can still
+    # read mode-000 files, so fall through to the same mocks Windows uses.
+    if (($IsLinux -or $IsMacOS) -and -not $runningAsRoot) {
         chmod 000 $Path
         return 'chmod'
     }
 
-    # Windows cannot chmod away readability; force the module read path to fail.
+    # Windows / root Unix: force the module read path to fail.
     # Ensure Read-FileContent is resolvable before Mock — FileContent may not be loaded
     # in every shard ordering, and Pester 5 cannot mock a missing command.
     if (-not (Get-Command Read-FileContent -ErrorAction SilentlyContinue)) {