test(lint): refuse a default in os.environ.get, and resolve the 25 sites

The deploy decides what ADAPTER_PORT or OPENWEBUI_ADMIN_NAME is and
writes it into the environment. A default in the reader is a second place
that value lives, and it is the one nobody greps for. os.environ["X"]
fails loudly on a missing key, which is the behaviour a misconfiguration
deserves.

Empty values stay free, because they add no second source and only say
absent: "", None, False, 0, the empty containers, and the "[]"/"{}" a
json.loads reader hands an absent variable. A default that is itself an
environ.get is free too, since it reads the one source again under
another key; a literal ending such a chain is still reported. Detection
runs on the parsed tree, so a call split across lines reads the same.

Five sites were real duplication and lost their default: the adapter
port, openwebui's admin name (a role that runs as a bot user), odoo's
OIDC uid field, seaweedfs' public-primary flag, and the swarm hosts
entry IP. Nineteen carry a nocheck naming why the value is not the
deploy's: contributor tooling whose default is the only source, test
scaffolding that writes the file it names, and two readers of
CA_TRUST_CERT_EXTRA_HOST, which nothing in the repo sets.

utils/diagnostics/container.py resolves without a marker: RESCUE_DEPTH is
a recursion base case, and the integer 0 says what the string "0" said.
The file sits exactly at the 500-line cap, so a comment line was not
available.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/roles/svc-ai-mcp-adapter/files/test_server.py

@@ -49,7 +49,11 @@ def load():
             "limits": LIMITS,
             "schema_sha256": policy.schema_digest(TOOLS),
         }
-        env = {"ADAPTER_CONTRACT": json.dumps(contract), "ADAPTER_BEARER": "real"}
+        env = {
+            "ADAPTER_CONTRACT": json.dumps(contract),
+            "ADAPTER_BEARER": "real",
+            "ADAPTER_PORT": "8080",
+        }
         with patch.dict("os.environ", env, clear=False):
             spec.loader.exec_module(module)
     finally:

tests/unit/python/roles/svc-ai-mcp-adapter/files/test_server_passthrough.py

@@ -59,7 +59,11 @@ def load(tools=None, *, mutating=False, transport=None):
         }
         if transport is not None:
             contract["upstream_transport"] = transport
-        env = {"ADAPTER_CONTRACT": json.dumps(contract), "ADAPTER_BEARER": "real"}
+        env = {
+            "ADAPTER_CONTRACT": json.dumps(contract),
+            "ADAPTER_BEARER": "real",
+            "ADAPTER_PORT": "8080",
+        }
         with patch.dict("os.environ", env, clear=False):
             spec.loader.exec_module(module)
     finally:

tests/unit/python/roles/web-app-openwebui/files/test_provision_mcp_grants.py

@@ -28,6 +28,7 @@ def load_script(
             "OPENWEBUI_MCP_MEMBERS": json.dumps(members or {}),
             "OPENWEBUI_MCP_CONNECTIONS": json.dumps(declared or []),
             "OPENWEBUI_ADMIN_EMAIL": "administrator@example.org",
+            "OPENWEBUI_ADMIN_NAME": "openwebui-api-bot",
             "OPENWEBUI_ADMIN_PASSWORD": "x" * 32,
         },
     ):