harden delivery pipeline and production runtime

tests/ml/test_model_registry.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+from pathlib import Path
 
 import pytest
 
@@ -8,7 +9,7 @@ from app.ml.registry.model_registry import ModelRegistry
 from app.ml.training import TrainedArtifact
 
 
-def test_registry_loads_persisted_artifacts_after_restart(tmp_path) -> None:
+def test_registry_loads_persisted_artifacts_after_restart(tmp_path: Path) -> None:
     registry = ModelRegistry(tmp_path)
     artifact = TrainedArtifact("model-v1", ("sensor.kitchen", "sensor.bedroom"))
     registry.register(artifact)
@@ -19,7 +20,7 @@ def test_registry_loads_persisted_artifacts_after_restart(tmp_path) -> None:
 
 
 @pytest.mark.parametrize("artifact_id", ["../escape", "nested/model", "..", ""])
-def test_registry_rejects_unsafe_artifact_ids(tmp_path, artifact_id: str) -> None:
+def test_registry_rejects_unsafe_artifact_ids(tmp_path: Path, artifact_id: str) -> None:
     registry = ModelRegistry(tmp_path)
 
     with pytest.raises(ValueError):
@@ -28,7 +29,7 @@ def test_registry_rejects_unsafe_artifact_ids(tmp_path, artifact_id: str) -> Non
     assert list(tmp_path.parent.glob("escape.json")) == []
 
 
-def test_registry_rejects_corrupt_persisted_artifact(tmp_path) -> None:
+def test_registry_rejects_corrupt_persisted_artifact(tmp_path: Path) -> None:
     (tmp_path / "broken.json").write_text(
         json.dumps({"artifact_id": "../broken", "supported_sensors": []}),
         encoding="utf-8",