chore(dev): let the test tasks take paths and record two harness landmines

`server:test:unit` and `e2e:test:e2e` hardcoded `./...` while AGENTS.md
documented a `paths` var they never read, and the e2e task documented
`focusFilter`/`labelFilter` it never passed to ginkgo either. A scoped server
run now takes 4s instead of 1m50s, so the documented way to target a package
finally exists; `server:test:ai` takes the same var.

The two landmines cost a wasted step and a failed test in this session:
namespaced task targets exist only in the root Taskfile, and
`logboek.Context()` special-cases exactly `context.Background()` while any
derived context without a bound logger panics.

`test-the-tests` gains the mutation hazard an independent review hit here: a
test whose only barrier before a real daemon is a validation error inside the
code being mutated provisions real infrastructure the moment that validation is
inverted, and hangs instead of failing when nothing drains its output.

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

Author: alexey-igrychev

.agents/skills/test-the-tests/SKILL.md

@@ -38,6 +38,13 @@ seen fail.
 
 ## Common ways a test looks strong but isn't
 
+- **A real daemon, cluster or network is one mutation away.** A test that reaches the code
+  under test through a validation error — "the driver is rejected, so `docker buildx create`
+  is never called" — has its only barrier inside the thing being mutated. Invert that
+  validation and the test provisions real infrastructure, leaves it behind, and hangs instead
+  of failing when nothing drains what the code writes. Neutralize the escape before relying
+  on it (an empty `PATH`, an unroutable address) and drain every pipe the code writes to, so
+  the fault fails the test rather than the machine running it.
 - **The assertion holds under the bug too.** A chain assertion like
   `index(a) < index(b) < index(c)` can pass under both the fix and the regression it's
   meant to catch if the scenario doesn't force them to disagree. Reshape the scenario (add

AGENTS.md

@@ -69,7 +69,7 @@ Follow [Effective Go](https://go.dev/doc/effective_go) and [Go Code Review Comme
 
 ## Commands (MANDATORY)
 
-ALWAYS use these `task` commands. NEVER use raw `go build`, `go test`, `go fmt`, `go vet`, or `golangci-lint` directly. trdl is a multi-module project — most commands are namespaced by module.
+ALWAYS use these `task` commands. NEVER use raw `go build`, `go test`, `go fmt`, `go vet`, or `golangci-lint` directly. trdl is a multi-module project — most commands are namespaced by module, and those namespaces exist only in the root Taskfile: ALWAYS run `task` from the repository root, never from inside `server/`, `client/`, `e2e/` or `release/`.
 
 ### Building
 - NEVER `go build` → ALWAYS use the appropriate build task:
@@ -96,6 +96,7 @@ ALWAYS use these `task` commands. NEVER use raw `go build`, `go test`, `go fmt`,
 
 ## Testing (MANDATORY)
 
+- `logboek.Context(ctx)` returns the default logger ONLY for exactly `context.Background()`; any derived context without a bound logger panics with `context is not bound with logboek logger`. In a test that reaches code logging through logboek, pass `context.Background()` unchanged or wrap it: `logboek.NewContext(ctx, logboek.DefaultLogger())`.
 - Server tests use Ginkgo/Gomega. `testify` (`assert`, `require`) is also available in the `server/` module.
 - E2E tests use Ginkgo/Gomega exclusively.
 - When writing tests as an AI agent → ALWAYS name the file `*_ai_test.go`, add `//go:build ai_tests` build tag, prefix test functions with `TestAI_`.

e2e/Taskfile.yaml

@@ -37,13 +37,14 @@ tasks:
       CGO_ENABLED: "0"
 
   test:e2e:
-    desc: "Run client e2e test."
+    desc: 'Run client e2e test. Important vars: "paths", "focusFilter", "labelFilter".'
     # On linux/amd64 the elf_signing suite links the delivery-kit-sdk CGO ELF
     # signer via the server import, so it needs the C libs from
     # server:deps:install:c. On other platforms that suite is skipped.
-    cmd: ginkgo --vv --keep-going --cover --covermode=atomic --coverpkg=github.com/werf/trdl/client/...,github.com/werf/trdl/server/... --output-dir={{.outputDir}} ./...
+    cmd: ginkgo --vv --keep-going --cover --covermode=atomic --coverpkg=github.com/werf/trdl/client/...,github.com/werf/trdl/server/... --output-dir={{.outputDir}} {{if .focusFilter}}--focus="{{.focusFilter}}" {{end}}{{if .labelFilter}}--label-filter="{{.labelFilter}}" {{end}}{{.paths}}
     vars:
       outputDir: '{{.outputDir | default "../tests_coverage/e2e" }}'
+      paths: '{{.paths | default "./..."}}'
 
   test:e2e:elf-signing:
     desc: "Run ELF signing e2e test (linux/amd64 with CGO; requires server:deps:install:c)."

server/Taskfile.yaml

@@ -323,14 +323,17 @@ tasks:
           goTags: "test_coverage"
 
   test:unit:
-    desc: "Run server unit tests."
-    cmd: ginkgo --vet=off --race --keep-going --cover --coverpkg=./... --output-dir={{.outputDir}} ./...
+    desc: 'Run server unit tests. Important vars: "paths".'
+    cmd: ginkgo --vet=off --race --keep-going --cover --coverpkg=./... --output-dir={{.outputDir}} {{.paths}}
     vars:
       outputDir: '{{.outputDir | default "../tests_coverage/unit"}}'
+      paths: '{{.paths | default "./..."}}'
 
   test:ai:
-    desc: "Run server tests written by AI agents (ai_tests build tag). Set TRDL_SMOKE_BUILDKITD_ADDRESS to include the buildkitd smoke test."
-    cmd: ginkgo --vet=off --race --keep-going --tags=ai_tests ./...
+    desc: 'Run server tests written by AI agents (ai_tests build tag). Set TRDL_SMOKE_BUILDKITD_ADDRESS to include the buildkitd smoke test. Important vars: "paths".'
+    cmd: ginkgo --vet=off --race --keep-going --tags=ai_tests {{.paths}}
+    vars:
+      paths: '{{.paths | default "./..."}}'
 
   verify:dist:binaries:
     desc: "Verify that the distributable binaries are built and have correct platform/arch."