Fix red master: keep the tests' Bundler runs out of OCRAN's own lockfile

[Largo]

master is red on Windows only, in the step Build zlib fixture for portability test:

You have deleted from the Gemfile:
* mylocal
... the lockfile can't be updated because frozen mode is set

Root cause

bundle exec exports BUNDLE_LOCKFILE holding the absolute path of the lockfile it used. The test suite runs under bundle exec rake test, so every child process it spawns inherits BUNDLE_LOCKFILE=<repo>/Gemfile.lock.

bundle_exec_env (added in #54) runs bundle exec ruby -e ... with BUNDLE_GEMFILE pointed at a fixture Gemfile — for test_bundle_exec_own_bundle_is_not_warned_about, test/fixtures/localgem/Gemfile, copied to a tmpdir. Bundler believes BUNDLE_LOCKFILE over the Gemfile it was handed, so it resolved the fixture and wrote the result — PATH remote: mylocal and nothing else — into OCRAN's own Gemfile.lock, not the fixture's.

Every platform did this. Only Windows noticed: its post-test zlib step runs bundle exec ruby ..., and ruby/setup-ruby has put deployment: true in .bundle/config, so Bundler refuses the rewritten lockfile. Linux and macOS run that step under plain ruby and stayed green while carrying the same damage.

(The repo-local deployment: true never applied to the offending call itself: with BUNDLE_GEMFILE in a tmpdir, .bundle/config is out of Bundler's root, so nothing stopped the write.)

Fix

• bundle_exec_env clears BUNDLE_LOCKFILE, which puts the lockfile back where Bundler would put it unaided — next to the Gemfile, i.e. inside the temporary copy that is deleted with the rest of the fixture. The tests still run real Bundler against real fixture Gemfiles; nothing is weakened.
• Every such Bundler run is followed by an assertion that OCRAN's lockfile still has its pre-run content, so the next variant of this names itself instead of surfacing three steps later.
• CI fails right after the test step if the run modified a tracked file (vendor/ and .bundle/ excluded — both are checked in but rewritten by bundle install and setup-ruby before any test runs).
• branches: ['*'] never matched fix/... or feat/...: a single star stops at a slash. Every branch here was merged untested, which is how the last two merges reached master red. Now '**', plus workflow_dispatch.

Verification

Windows on this branch, run https://github.com/Largo/ocran/actions/runs/31359567122 — run-tests-windows 3.3 / 3.4 / 4.0 and all three test-windows-portability jobs green. Linux and macOS jobs were still waiting for runners at the time of writing; locally, bundle exec rake test leaves the tree clean and shows only this box's known failures.

🤖 Generated with Claude Code