test: pin the loopback requirement in the install-denial constants

[Dhevenddra]

Problem

is_dedicated_install_allowed gates on flag AND loopback. ffb2f03 rewrote SECURITY_MESSAGE_FLAG_GIT_URL and SECURITY_MESSAGE_FLAG_PIP to state both halves, because a message naming only the flag sends a non-loopback user back to re-check a setting they had already enabled.

_assert_honest_copy already pins the rest of that copy: the flag name, config.ini, and the absence of security_level phrasings that would misattribute the cause. The loopback half is not pinned, so a later edit can drop it again without failing a test.

Fix

One assertion in the existing helper, which covers both constants through test_flag_constants_content.

Evidence

Against main at f39cbd5, Python 3.11.9:

$ python -m unittest tests.test_install_flags_gates
Ran 11 tests in 0.042s

OK

The suite passes unchanged with the assertion added. To confirm it is load-bearing rather than vacuous, removing the loopback clause from SECURITY_MESSAGE_FLAG_GIT_URL fails it:

AssertionError: 'loopback' not found in "ERROR: This action requires
'allow_git_url_install = true' in config.ini ([default] section). ..."
: constant must name the loopback requirement

Ran 11 tests in 0.038s

FAILED (failures=1)

Note

This is the part of #3136 that still applies. I opened that one before ffb2f03, 4fe65b0 and 98be899 landed, and those cover the behaviour it was proposing and more, so I have closed it as superseded.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 60e2c3a4-0c90-4193-aa34-bd8250885d6c

📥 Commits

Reviewing files that changed from the base of the PR and between f39cbd5 and 23519a3.

📒 Files selected for processing (1)

• tests/test_install_flags_gates.py

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The denial constant validation now checks that each constant names the loopback requirement in the flag AND loopback install gate.

Changes

Install flag validation

Layer / File(s)	Summary
Denial constant content checks tests/test_install_flags_gates.py	_assert_honest_copy now asserts that each denial constant contains loopback, in addition to the flag name and config.ini checks.

Merge Risk: ⚪ Minimal · up to 23519

This localized test-only change strengthens coverage for the required loopback wording in install-denial messages, with no production behavior change or actionable merge-blocking risk remaining.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}