Add a `test` workflow that runs `mise run verify` (ruff lint + pytest) on
every push and PR, dogfooding the same verify task the control layer's Stop
hook enforces — giving CI visibility into the suite.
Also clear HANDLER_SECRET_KEY and CLAUDE_BIN in the `env` test fixture. When
the suite runs inside a Handler-managed container these are set in the ambient
environment and leaked into tests asserting the unset behavior (secretstore
refusing without a key; login using the default `claude` binary), which then
failed. Clearing them (as the fixture already does for WEBHOOK_URL) keeps
behavior test-driven, not host-driven.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tester