fix(alloy): make the copier's refusal case actually refuse

The engine-rejects test corrupted its own cfg file, but the copier always
renders from the repo config, so the gate validated a good file and
installed it; the test only surfaced where it was written, not where it
broke, because '!' suppresses errexit. Add an ALLOY_CONFIG_SRC seam
(alongside the *_CONF_ROOT seams) so the refusal case feeds the copier
the broken config it claims to test, and pin the repo-relative sed paths
to $REPO_ROOT — run.sh cds into tests/, so the relative path was dead
on any box that has the alloy image.

scripts/deploy-remote.sh

@@ -323,11 +323,13 @@ copy_alloy_config() {
     # The repo config carries the token GRAFANA_HOST_LABEL; the installed copy
     # carries the host's name, so Loki streams say WHICH machine's journal a
     # line came from without a second config file per host.
-    # *_CONF_ROOT are test seams: the bats cases execute these copiers for
-    # real against a sandbox with a stubbed run_privileged.
+    # *_CONF_ROOT and ALLOY_CONFIG_SRC are test seams: the bats cases execute
+    # these copiers for real against a sandbox with a stubbed run_privileged;
+    # ALLOY_CONFIG_SRC lets the refusal case feed a deliberately broken config.
     local root="${ALLOY_CONF_ROOT:-/opt/alloy}" tmp
+    local src="${ALLOY_CONFIG_SRC:-shared/alloy/config.alloy}"
     tmp="$(mktemp)"
-    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" shared/alloy/config.alloy > "$tmp"
+    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" "$src" > "$tmp"
     if ! grep -q "host = \"$TARGET\"," "$tmp" || grep -q "GRAFANA_HOST_LABEL" "$tmp"; then
         echo "alloy config: host-label substitution failed" >&2
         rm -f "$tmp"

tests/observability_quadlet.bats

@@ -799,14 +799,13 @@ assert not any('container_network' in e or 'container_fs_' in e for e in names),
         skip "franksdank/alloy image not present on this box"
     fi
     local sandbox="$BATS_TEST_TMPDIR/opt" cfg="$BATS_TEST_TMPDIR/broken.alloy"
-    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' shared/alloy/config.alloy > "$cfg"
+    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' "$REPO_ROOT/shared/alloy/config.alloy" > "$cfg"
     printf 'bogus_attr = "x"\n' >> "$cfg"
     ! (
         cd "$REPO_ROOT"
         eval "$(sed -n '/^copy_alloy_config()/,/^}/p' scripts/deploy-remote.sh)"
         run_privileged() { "$@"; }
-        cp() { if [ "$1" = "$cfg" ]; then return 1; fi; command cp "$@"; }
-        export TARGET=dankclaw ALLOY_CONF_ROOT="$sandbox"
+        export TARGET=dankclaw ALLOY_CONF_ROOT="$sandbox" ALLOY_CONFIG_SRC="$cfg"
         copy_alloy_config
     )
     [ ! -f "$sandbox/config/config.alloy" ]
@@ -820,7 +819,7 @@ assert not any('container_network' in e or 'container_fs_' in e for e in names),
         skip "franksdank/alloy image not present on this box"
     fi
     local cfg="$BATS_TEST_TMPDIR/rendered.alloy"
-    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' shared/alloy/config.alloy > "$cfg"
+    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' "$REPO_ROOT/shared/alloy/config.alloy" > "$cfg"
     podman run --rm -v "$cfg:/c.alloy:ro" --entrypoint /usr/bin/alloy \
         localhost/franksdank/alloy:latest validate /c.alloy
 }