PR 1 of a stack of 8 that tests basecamp connect end to end. It is stacked on #822 (the fake Basecamp) and changes no behaviour of the CLI.

Why

The connect setup tests ran against connectSetupServer, a mock that answered most reads to any bearer and modeled each scenario as a field (refuseAgentReads, agentAsUser, boss, agentProjects, refuseSecret, rateLimitMints, ...). It drifted from Basecamp in small ways: project reads ignored membership, the project list was a separate field from what the agent could read, and the client secret never rotated. One fake for every connect test means a scenario is set up the way Basecamp would be, and the later e2e PRs run against the same one.

What

connect_setup_test.go, connect_setup_guided_test.go, connect_operator_test.go, connect_start_wait_test.go and profile_layers_test.go now run against internal/connector/fakebasecamp. connectSetupServer is deleted.

Each old knob is now a fact of the world or a fault:

• agentProjects -> the agent's project membership (agentOnProjects). The list and the reads agree now.
• boss -> BossID on the agent (ownedByTheOperator).
• refusePeople and the "Colleague" -> ReadableBy on the person (readableOnlyBy).
• agentAsUser -> Agent: false; grantScope -> Connection.Scope.
• agentID = 777 and agentID++ -> the client and its tokens repointed at another Agent (repointAgent).
• refuseSecret -> the secret rotated by a connection on another computer (connectedElsewhere). The fake then refuses it with invalid_client, and the reconnect rotates in a secret it accepts. No fault and no toggle are needed.
• refuseAgentReads -> 403 on project and project people reads, for Agents only.
• mintFailure -> a 422 fault on the stream ticket; agentID = 0 -> a 200 fault with a profile that has no id.
• duringMint -> Before(RouteStreamTicket, ...); rateLimitMints -> TokenRateLimited(3600); mints and intakeCount -> Count(...).

One addition to the fake: Server.Tickets() returns every stream ticket it issued. The tests check that a command never prints a ticket, so they need the real ticket values, and tickets are not part of the World. It has its own test in fakebasecamp.

Assertions. Every assertion is kept. Some are stronger now:

• The secret checks use the secret the ceremony rotated in, read from the world, not a constant.
• The ticket checks cover every ticket issued, and the first test asserts that a ticket was minted.
• TestGuidedConnectSetupLeavesARefusedCredentialThePersonKeeps now also checks that the refusal was explained and that the reconnect question was asked. Before, it passed even with a credential that was not refused.
• Hooks that run on the fake's goroutine use assert, not require.

Tests

• bin/ci green.
• The affected tests pass with go test -race -count=10 (1100 runs, no failures, no races).
• Mutation check: when the secret rotation or ReadableBy has no effect, the tests that depend on them fail.
• Timings are the same as before. The ceremony's 1s poll interval was already the main cost.

Summary by cubic

Migrates the connect setup tests from the custom connectSetupServer mock to the shared fake Basecamp, with no CLI behavior changes.

Refactor

• Each old mock knob is now a world fact or an injected fault, including project membership, a profile boss, people readable only by some, a rotated client secret, and a token repointed at another agent.
• The fake Basecamp gains Tickets(), listing every stream ticket it issued, so no-echo assertions compare against real tickets.
• Assertions are stronger: secret checks read the rotated secret from the world, and the refused-credential test now verifies the refusal explanation and reconnect prompt.

^{Written for commit 01f042c. Summary will update on new commits.}