fix(test): isolate Darwin Rancher Desktop Docker discovery #1456

Problem

TestFindDarwinDockerCLIRancherDesktopPath creates a temporary Rancher executable but searches the real production candidate list. An installed Docker executable earlier in that list legitimately wins, causing the test's Rancher-only expectation to fail. Production discovery precedence is intentional.

Current baseline: 511d21603e602d3081a7df8a19521b481b45adeb.

• Affected test
• Candidate ordering and discovery

The named test failed without exclusions on PATH head 5d1cb4a64fba239a33afd8c72292e5fdb14c7e2f and pristine main 74810ddd4de91fb6061eb3263108b84ea48e5f3d, selecting /usr/local/bin/docker instead of its temporary fixture. PR #1447 discloses the failure and excluded-test limitation. Current main retains the same test and production source. A fresh read-only audit found no duplicate correction among six open issues or overlap among 13 open PR file sets on October 10, 2026.

Narrow correction

Change only cmd/internal/agentworkspace/docker_darwin_test.go:

1. Assert separately that darwinDockerCandidatePaths(home) contains the temporary Rancher path, using slices.Contains.
2. Call findDarwinDockerCLIInPaths with test-owned absolute paths: a missing candidate followed by the executable Rancher fixture.
3. Retain the existing error/path assertion and all seven discovery tests.

Preserve production precedence, explicit Docker configuration, diagnostics, fixture modes and controlled precedence/access assertions. Do not change host installations, permissions, PATH/DOCKER_PATH, workflows, timeouts or add skips. Keep this separate from #1446/#1447, #1452/#1455 and #1449.

Validation and acceptance

Historical corrected-fixture evidence reported seven passing tests, but its full command was not retained; fresh final-head validation is required. No tests were run during the current source audit.

• Refresh main and overlap before implementation; keep the diff limited to the one test file.
• On native Darwin, run the named test uncached, repeat with -count=20, and run focused race coverage.
• Run the complete affected package normally and with -race -short -count=1, without -run or -skip exclusions.
• Run affected-package vet, repository unit task, CI-parity lint and applicable hooks.
• Compare relevant baseline/final analyzer results; disclose unsupported test-file coverage and claim no production score improvement.
• Complete local review and actual exact-head CodeRabbit/Greptile reviews plus required CI. Publish an initially draft PR with Closes and a personally signed, GitHub-verified commit.
• Preserve exact commands and passed/failed/blocked/unrun results; rerun affected gates after edits or integration changes.
• Verify protected merge, issue closure and merge-commit workflows.

Existing Ubuntu/macOS unit CI runs race/short tests. Linux execution and cross-compilation do not establish Darwin-tagged test execution.

Rollback is the inverse test-only diff. If investigation reveals a production discovery defect, report and scope it separately.