fix(v0.59.0): rewrite null-byte env test — OS layer rejects setenv on every platform

The previous test_default_log_path_rejects_null_byte_env used monkeypatch.setenv
to inject a null byte into SOUP_AUDIT_LOG_PATH and expected default_log_path
to fall back gracefully. But the OS layer rejects null bytes in env vars on
every platform we ship on:

- POSIX (Linux/macOS): `ValueError: embedded null byte`
- Windows: `ValueError: embedded null character`

The setenv call itself raises, never reaching default_log_path. Split into two
tests that hit the actual validation surfaces:

1. test_default_log_path_rejects_null_byte_override — calls the private
   _validate_log_path_override helper directly with a null-byte string and
   asserts it returns None (so the caller falls back to the safe default).

2. test_default_log_path_handles_env_read_value_error — monkeypatches
   os.environ.get to raise ValueError, exercising the defence-in-depth
   try/except around the env read in default_log_path().

Both tests pass on Linux + macOS + Windows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_v0590.py

@@ -1104,13 +1104,33 @@ class TestReviewFollowups:
         resolved = default_log_path()
         assert resolved == str(target)
 
-    def test_default_log_path_rejects_null_byte_env(self, monkeypatch, tmp_path):
-        from soup_cli.utils.audit_log import default_log_path
+    def test_default_log_path_rejects_null_byte_override(self):
+        """The OS layer rejects null bytes in env vars on every platform we ship
+        on (POSIX raises ValueError, Windows raises "embedded null character"),
+        so we cannot inject one via monkeypatch.setenv. Test the validator
+        directly instead — it must return None for any null-byte path so the
+        caller falls back to the safe default."""
+        from soup_cli.utils.audit_log import _validate_log_path_override
+
+        assert _validate_log_path_override("/tmp/\x00/audit.jsonl") is None
+
+    def test_default_log_path_handles_env_read_value_error(self, monkeypatch, tmp_path):
+        """If the env layer somehow raises ValueError on read (defence in depth
+        for the POSIX `embedded null byte` path), default_log_path must still
+        return a safe default."""
+        from soup_cli.utils import audit_log
 
         monkeypatch.chdir(tmp_path)
-        monkeypatch.setenv("SOUP_AUDIT_LOG_PATH", "/tmp/\x00/audit.jsonl")
-        resolved = default_log_path()
+
+        def boom(key, default=None):
+            if key == "SOUP_AUDIT_LOG_PATH":
+                raise ValueError("embedded null byte")
+            return os.environ.get(key, default)
+
+        monkeypatch.setattr(audit_log.os.environ, "get", boom)
+        resolved = audit_log.default_log_path()
         assert "\x00" not in resolved
+        assert resolved.endswith("audit.jsonl")
 
     # --- Code review #2 / Security L1: artifact size_bytes validation ---
     def test_bom_artifact_size_bytes_non_int_rejected(self):