[dgsienko]

Test half of the slop audit. Every kept or rewritten test was spot-mutated: delete the line it guards and confirm the test fails.

• The four PTY "integration" tests never called diffui. They're replaced by one test that runs _spawn_agent for real.
• Tests that couldn't fail now assert exact values. That covers requests for files the fixture repo lacked, if data: and pytest.skip guards, and status-200-only checks for context and ignore_whitespace.
• Repeated cases are folded into parametrized tables (comment fields, settings, risk, apply-suggestion, diff helpers).
• Tests that ran against the live diffui checkout run on temp_repo. One autouse fixture resets comments, reviewed state and the active repo, which replaces about 25 inline cleanup loops.
• Mock-call-count and private-state tests are gone.
• test_server.py goes from 1579 to 689 lines, as a pure move into test_comments.py, test_search.py and test_risk.py.

372 tests become 308, with no change in wall time, since the TUI tests take most of it. No test needs origin/main now, so CI drops fetch-depth: 0.

The TUI search tests now wait for the row Enter would open, not for any two rows. A timeout prints the rows it saw. This targets the macOS flake on #26, which didn't reproduce locally.