test(e2e): enforce --system-update and isolate update-all integration tests

- Require --system-update for update-all integration tests
- Run tests with isolated HOME and temporary gitconfig
- Allow /src as git safe.directory for nix run
- Capture and print combined stdout/stderr on failure
- Ensure consistent environment for pkgmgr and nix-run executions

tests/e2e/test_update_all.py

@@ -8,13 +8,17 @@ This test is intended to be run inside the Docker container where:
   - and it is safe to perform real git operations.
 
 It passes if BOTH commands complete successfully (in separate tests):
-  1) pkgmgr update --all --clone-mode https --no-verification
-  2) nix run .#pkgmgr -- update --all --clone-mode https --no-verification
+  1) pkgmgr update --all --clone-mode https --no-verification --system-update
+  2) nix run .#pkgmgr -- update --all --clone-mode https --no-verification --system-update
 """
 
+from __future__ import annotations
+
 import os
 import subprocess
+import tempfile
 import unittest
+from pathlib import Path
 
 from test_install_pkgmgr_shallow import (
     nix_profile_list_debug,
@@ -23,68 +27,97 @@ from test_install_pkgmgr_shallow import (
 )
 
 
-class TestIntegrationUpdateAllHttps(unittest.TestCase):
-    def _run_cmd(self, cmd: list[str], label: str) -> None:
-        """
-        Run a real CLI command and raise a helpful assertion on failure.
-        """
-        cmd_repr = " ".join(cmd)
-        env = os.environ.copy()
+def _make_temp_gitconfig_with_safe_dirs(home: Path) -> Path:
+    gitconfig = home / ".gitconfig"
+    gitconfig.write_text(
+        "[safe]\n"
+        "\tdirectory = /src\n"
+        "\tdirectory = /src/.git\n"
+        "\tdirectory = *\n"
+    )
+    return gitconfig
 
-        try:
+
+class TestIntegrationUpdateAllHttps(unittest.TestCase):
+    def _common_env(self, home_dir: str) -> dict[str, str]:
+        env = os.environ.copy()
+        env["HOME"] = home_dir
+
+        home = Path(home_dir)
+        home.mkdir(parents=True, exist_ok=True)
+
+        env["GIT_CONFIG_GLOBAL"] = str(_make_temp_gitconfig_with_safe_dirs(home))
+
+        # Ensure nix is discoverable if the container has it
+        env["PATH"] = "/nix/var/nix/profiles/default/bin:" + env.get("PATH", "")
+
+        return env
+
+    def _run_cmd(self, cmd: list[str], label: str, env: dict[str, str]) -> None:
+        cmd_repr = " ".join(cmd)
         print(f"\n[TEST] Running ({label}): {cmd_repr}")
-            subprocess.run(
+
+        proc = subprocess.run(
             cmd,
-                check=True,
+            check=False,
             cwd=os.getcwd(),
             env=env,
             text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
         )
-        except subprocess.CalledProcessError as exc:
+
+        print(proc.stdout.rstrip())
+
+        if proc.returncode != 0:
             print(f"\n[TEST] Command failed ({label})")
             print(f"[TEST] Command : {cmd_repr}")
-            print(f"[TEST] Exit code: {exc.returncode}")
+            print(f"[TEST] Exit code: {proc.returncode}")
 
             nix_profile_list_debug(f"ON FAILURE ({label})")
 
             raise AssertionError(
-                f"({label}) {cmd_repr!r} failed with exit code {exc.returncode}. "
-                "Scroll up to see the full pkgmgr/nix output inside the container."
-            ) from exc
+                f"({label}) {cmd_repr!r} failed with exit code {proc.returncode}.\n\n"
+                f"--- output ---\n{proc.stdout}\n"
+            )
 
     def _common_setup(self) -> None:
-        # Debug before cleanup
         nix_profile_list_debug("BEFORE CLEANUP")
-
-        # Cleanup: aggressively try to drop any pkgmgr/profile entries
-        # (keeps the environment comparable to other integration tests).
         remove_pkgmgr_from_nix_profile()
-
-        # Debug after cleanup
         nix_profile_list_debug("AFTER CLEANUP")
 
     def test_update_all_repositories_https_pkgmgr(self) -> None:
-        """
-        Run: pkgmgr update --all --clone-mode https --no-verification
-        """
         self._common_setup()
-
-        args = ["update", "--all", "--clone-mode", "https", "--no-verification"]
-        self._run_cmd(["pkgmgr", *args], label="pkgmgr")
-
-        # After successful update: show `pkgmgr --help` via interactive bash
+        with tempfile.TemporaryDirectory(prefix="pkgmgr-updateall-") as tmp:
+            env = self._common_env(tmp)
+            args = [
+                "update",
+                "--all",
+                "--clone-mode",
+                "https",
+                "--no-verification",
+                "--system-update",
+            ]
+            self._run_cmd(["pkgmgr", *args], label="pkgmgr", env=env)
             pkgmgr_help_debug()
 
     def test_update_all_repositories_https_nix_pkgmgr(self) -> None:
-        """
-        Run: nix run .#pkgmgr -- update --all --clone-mode https --no-verification
-        """
         self._common_setup()
-
-        args = ["update", "--all", "--clone-mode", "https", "--no-verification"]
-        self._run_cmd(["nix", "run", ".#pkgmgr", "--", *args], label="nix run .#pkgmgr")
-
-        # After successful update: show `pkgmgr --help` via interactive bash
+        with tempfile.TemporaryDirectory(prefix="pkgmgr-updateall-nix-") as tmp:
+            env = self._common_env(tmp)
+            args = [
+                "update",
+                "--all",
+                "--clone-mode",
+                "https",
+                "--no-verification",
+                "--system-update",
+            ]
+            self._run_cmd(
+                ["nix", "run", ".#pkgmgr", "--", *args],
+                label="nix run .#pkgmgr",
+                env=env,
+            )
             pkgmgr_help_debug()