test: isolate registry package state in tests (#280)

Reset registry test globals more completely, tighten the overlay pollution regressions, and ensure tenant scope coverage tests rebuild a fresh isolated registry before asserting.

internal/registry/registry_test.go

@@ -9,6 +9,14 @@ import (
 	"testing"
 )
 
+func ensureFreshRegistry(t *testing.T) {
+	t.Helper()
+	resetInit()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	t.Setenv("LARKSUITE_CLI_REMOTE_META", "off")
+	Init()
+}
+
 func TestLoadScopePriorities(t *testing.T) {
 	priorities := LoadScopePriorities()
 	if len(priorities) == 0 {
@@ -123,6 +131,7 @@ func TestComputeMinimumScopeSet(t *testing.T) {
 }
 
 func TestComputeMinimumScopeSet_Tenant(t *testing.T) {
+	ensureFreshRegistry(t)
 	minSet := ComputeMinimumScopeSet("tenant")
 	if len(minSet) == 0 {
 		if len(ListFromMetaProjects()) == 0 {

internal/registry/remote_test.go

@@ -22,13 +22,29 @@ func resetInit() {
 	initOnce = sync.Once{}
 	mergedServices = make(map[string]map[string]interface{})
 	mergedProjectList = nil
+	embeddedVersion = ""
 	cachedAllScopes = nil
+	cachedScopePriorities = nil
+	cachedAutoApproveSet = nil
+	cachedPlatformAutoApprove = nil
+	cachedOverrideAutoAllow = nil
+	cachedOverrideAutoDeny = nil
 	refreshOnce = sync.Once{}
 	configuredBrand = ""
 	enableRemoteMeta = true // tests exercise remote logic
 	testMetaURL = ""
 }
 
+func TestResetInitClearsEmbeddedVersion(t *testing.T) {
+	embeddedVersion = "stale-version"
+
+	resetInit()
+
+	if embeddedVersion != "" {
+		t.Fatalf("embeddedVersion = %q, want empty", embeddedVersion)
+	}
+}
+
 // hasEmbeddedServices returns true if meta_data.json with real services is compiled in.
 func hasEmbeddedServices() bool {
 	if len(embeddedMetaJSON) == 0 {
@@ -299,6 +315,30 @@ func TestOverlayMergedServices(t *testing.T) {
 	}
 }
 
+func TestOverlayMergedServicesDoesNotPolluteFollowingInit(t *testing.T) {
+	resetInit()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	t.Setenv("LARKSUITE_CLI_REMOTE_META", "off")
+
+	const leakedExisting = "test_isolation_existing_sentinel"
+	const leakedOverlay = "test_isolation_overlay_sentinel"
+
+	mergedServices = map[string]map[string]interface{}{
+		leakedExisting: {"name": leakedExisting, "version": "v1"},
+	}
+	overlayMergedServices(&MergedRegistry{Services: []map[string]interface{}{{"name": leakedOverlay, "version": "v1"}}})
+
+	resetInit()
+	Init()
+
+	if spec := LoadFromMeta(leakedExisting); spec != nil {
+		t.Fatalf("polluted service %q survived resetInit", leakedExisting)
+	}
+	if spec := LoadFromMeta(leakedOverlay); spec != nil {
+		t.Fatalf("polluted service %q survived resetInit", leakedOverlay)
+	}
+}
+
 func TestFetchRemoteMerged_200(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(200)