feat: strengthen Tobserver checks and PR inspection

tobserver-change/tests/tobserver-agent-test

@@ -55,6 +55,35 @@ expect_failure() {
   fi
 }
 
+expect_contains() {
+  local name=$1
+  local haystack=$2
+  local needle=$3
+
+  if [[ "$haystack" == *"$needle"* ]]; then
+    pass "$name"
+  else
+    printf 'missing: %q\n' "$needle" >&2
+    fail "$name"
+  fi
+}
+
+strict_eval_config() {
+  local config=$1
+  local apply_expression
+
+  apply_expression=$(strict_nixos_apply_expression)
+  nix eval --raw --expr \
+    "let strict = ($apply_expression); config = $config; in strict config"
+}
+
+toplevel_eval_config() {
+  local config=$1
+
+  nix eval --raw --expr \
+    "let config = $config; in config.system.build.toplevel.drvPath"
+}
+
 valid_pr_json() {
   cat <<'JSON'
 {
@@ -62,6 +91,8 @@ valid_pr_json() {
   "state": "open",
   "merged": false,
   "user": {"login": "oibot"},
+  "title": "Enable garbage collection",
+  "body": "Original pull-request description.",
   "base": {"ref": "main"},
   "head": {
     "repo": {"full_name": "oibot/Tobserver"},
@@ -113,6 +144,71 @@ expect_failure \
   "unexpected PR head ref is rejected" \
   assert_revisable_pull_request "$wrong_head" 17
 
+lazy_unit_config='{ assertions = []; systemd.units.bad.text = builtins.throw "malformed unit text"; system.build.toplevel.drvPath = "/nix/store/lazy-toplevel"; }'
+false_assertion_config='{ assertions = [{ assertion = false; message = "deliberate failed assertion"; }]; systemd.units = {}; system.build.toplevel.drvPath = "/nix/store/assertion-toplevel"; }'
+valid_strict_config='{ assertions = [{ assertion = true; message = "passes"; }]; systemd.units.example.text = "[Unit]"; system.build.toplevel.drvPath = "/nix/store/strict-toplevel"; }'
+lazy_passing_message_config='{ assertions = [{ assertion = true; message = builtins.throw "unused passing message"; }]; systemd.units.example.text = "[Unit]"; system.build.toplevel.drvPath = "/nix/store/lazy-message-toplevel"; }'
+
+expect_success \
+  "top-level drvPath fixture remains lazy" \
+  toplevel_eval_config "$lazy_unit_config"
+expect_failure \
+  "strict evaluation catches malformed systemd unit text" \
+  strict_eval_config "$lazy_unit_config"
+expect_failure \
+  "strict evaluation rejects a false NixOS assertion" \
+  strict_eval_config "$false_assertion_config"
+expect_success \
+  "strict evaluation accepts rendered units and passing assertions" \
+  strict_eval_config "$valid_strict_config"
+expect_success \
+  "strict evaluation does not force messages for passing assertions" \
+  strict_eval_config "$lazy_passing_message_config"
+
+fetch_json_url() {
+  case "$1" in
+    *'/issues/17/comments?limit=50&page=1')
+      printf '%s\n' '[{"user":{"login":"reviewer"},"created_at":"2026-07-24T12:00:00Z","html_url":"https://codeberg.org/oibot/Tobserver/pulls/17#issuecomment-1","body":"General discussion feedback."}]'
+      ;;
+    *'/pulls/17/reviews?limit=50&page=1')
+      printf '%s\n' '[{"id":73,"state":"REQUEST_CHANGES","user":{"login":"reviewer"},"submitted_at":"2026-07-24T12:01:00Z","commit_id":"0123456789abcdef","body":"Review summary."}]'
+      ;;
+    *'/pulls/17/reviews/73/comments?limit=50&page=1')
+      printf '%s\n' '[{"path":"modules/example.nix","user":{"login":"reviewer"},"html_url":"https://codeberg.org/oibot/Tobserver/pulls/17#issuecomment-2","diff_hunk":"@@ -1 +1 @@","body":"Inline correction."}]'
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+review_bundle_json=$(pull_request_review_bundle_json 17 "$(valid_pr_json)")
+review_bundle=$(render_pull_request_review_bundle <<<"$review_bundle_json")
+expect_contains \
+  "review bundle includes pull-request description" \
+  "$review_bundle" \
+  "Original pull-request description."
+expect_contains \
+  "review bundle includes general discussion" \
+  "$review_bundle" \
+  "General discussion feedback."
+expect_contains \
+  "review bundle includes review state and body" \
+  "$review_bundle" \
+  "Review 73 — REQUEST_CHANGES"
+expect_contains \
+  "review bundle includes review summary" \
+  "$review_bundle" \
+  "Review summary."
+expect_contains \
+  "review bundle includes inline path and comment" \
+  "$review_bundle" \
+  'modules/example.nix'
+expect_contains \
+  "review bundle includes inline correction" \
+  "$review_bundle" \
+  "Inline correction."
+
 expect_equal \
   "canonical PR URL yields number" \
   "17" \
@@ -139,5 +235,11 @@ else
   fail "help documents tokenless boundary"
 fi
 
+if "$HELPER" --help | grep -q 'inspect PR_NUMBER'; then
+  pass "help documents pull-request inspection"
+else
+  fail "help documents pull-request inspection"
+fi
+
 printf '\n%d passed; %d failed\n' "$passes" "$failures"
 ((failures == 0))