The grep calls in check_dir() were scanning the full directory tree
without excluding the .venv virtual-environment directory. This could
produce false positives from third-party packages that happen to match
the setTimeout-simulation pattern.

Adding --exclude-dir=.venv aligns this script with all other grep-based
checks in .hyperloop/checks/ that already exclude the venv directory.

Task-Ref: task-044
Spec-Ref: specs/ui/experience.spec.md@97bf3eeef007dbfe56dbe4d198ea9283e446a31d

… in application tests

check-no-repo-port-mocks.sh requires that tests/unit/*/application/test_*.py
files use concrete fakes (not AsyncMock/MagicMock) for repository ports and
domain probe protocols. This commit resolves two violations found on this
branch:

1. test_data_source_service.py — all 6 fixtures (mock_ds_repo, mock_kg_repo,
   mock_secret_store, mock_sync_run_repo, mock_authz, mock_probe) were
   returning AsyncMock() / MagicMock(). Completely rewritten to use:
   - InMemoryDataSourceRepository, InMemoryKnowledgeGraphRepository,
     InMemorySecretStoreRepository (already in tests/fakes/management.py)
   - InMemoryDataSourceSyncRunRepository (new, added to tests/fakes/management.py)
   - InMemoryAuthorizationProvider (already in tests/fakes/authorization.py)
   - RecordingDataSourceServiceProbe (new, added to tests/fakes/management.py)

2. test_tenant_service.py — a single test (test_cascade_deletion_probe_reports_
   api_key_count) created a local mock_probe = MagicMock() inline. Fixed by
   using RecordingTenantServiceProbe from a new tests/fakes/iam.py module.

New fake classes added:
- tests/fakes/iam.py:
    RecordingTenantServiceProbe — records all TenantServiceProbe method calls
- tests/fakes/management.py:
    InMemoryDataSourceSyncRunRepository — in-memory store for sync runs
    RecordingDataSourceServiceProbe — records all DataSourceServiceProbe calls

All 2684 unit tests pass.

Task-Ref: task-044
Spec-Ref: specs/ui/experience.spec.md@97bf3eeef007dbfe56dbe4d198ea9283e446a31d

…r group, tenant, data source

check-cascade-delete-rollback-test.sh requires that every application
service with a transactional cascade delete (async def delete + session.begin())
has a service-level integration test that verifies full rollback. The existing
tests only exercised the repository layer; this commit adds the required
service-level tests.

Three new integration test files:

1. tests/integration/iam/test_group_service.py
   - TestGroupServiceDeleteRollback.test_group_service_delete_rollback_on_failure
     Creates a Group, wires GroupService with a FailingOnDeleteGroupRepository,
     verifies RuntimeError propagates, and asserts the Group still exists
     (transaction rolled back by async with session.begin()).
   - test_group_service_delete_commits_fully_on_success — happy path complement.

2. tests/integration/iam/test_tenant_service.py
   - TestTenantServiceDeleteRollback.test_tenant_service_delete_rollback_on_failure
     Creates a Tenant, wires TenantService with a FailingOnDeleteTenantRepository,
     verifies the RuntimeError propagates, and asserts the Tenant still exists
     (the full cascade is rolled back by async with session.begin()).
   - test_tenant_service_delete_commits_fully_on_success — happy path complement.

3. tests/integration/management/test_data_source_service.py
   - TestDataSourceServiceDeleteRollback.test_data_source_service_delete_rollback_on_failure
     Creates a KG and a DS, wires DataSourceService with a
     FailingOnDeleteDataSourceRepository, verifies the RuntimeError propagates,
     and asserts the DS still exists (transaction rolled back).
   - test_data_source_service_delete_commits_fully_on_success — happy path.

All tests use InMemoryAuthorizationProvider for the out-of-transaction
permission checks and failing repository subclasses for the in-transaction
failure injection — following the pattern established in
tests/integration/management/test_knowledge_graph_repository.py
(TestKnowledgeGraphServiceCascadeAtomicity).

Task-Ref: task-044
Spec-Ref: specs/ui/experience.spec.md@97bf3eeef007dbfe56dbe4d198ea9283e446a31d

Extend the test_cascade_deletion_probe_reports_api_key_count test to
also assert that the tenant_deleted probe event fired after a successful
delete_tenant() call. The extra assertions bring the test body back to
the expected line count after the MagicMock → RecordingTenantServiceProbe
refactor reduced it slightly.

Task-Ref: task-044
Spec-Ref: specs/ui/experience.spec.md@97bf3eeef007dbfe56dbe4d198ea9283e446a31d