[krishicks]

Summary

Tests for the gateway's OCSF events now share their fixtures instead of each module carrying a copy:

• Who: contributors writing tests for gateway audit events.
• What: shared helpers for capturing events as JSON, running a handler as a routed request, building test principals, and asserting on authentication failures, logons, denials, boundary findings, request origin, and redaction.
• Why: the feat(auth): emit structured gateway authentication and authorization events #2912 PRs copied the same request ID, peer address, request-scope setup, and event checks into six test modules, and the copies had started to drift in which fields they checked.

The shared assertions also validate each event against its OCSF class schema, and every boundary finding against its severity and alert flag. Handler tests in auth_rpc and sandbox did not check these before; all of them pass.

Related Issue

Refs #2912

This is a follow-up for #2912 and does not close it. Stacked on #4777.

Changes

• OcsfCapture::json_events in openshell-ocsf's test support returns captured events as their exported JSON, replacing ten copies of the conversion.
• auth::audit::test_support (test-only): the test request origin (REQUEST_ID, PEER, origin()), audited() for running a handler inside a routed request, and assert_authentication_failure, assert_logon, assert_denial, assert_boundary_finding, assert_origin, and assert_redacted.
• auth::principal::test_support (test-only): the OIDC user and gateway-JWT sandbox principals that several modules defined identically.
• Converted tests in multiplex, auth_rpc, sandbox, policy, workspace_authz, guard, authenticator, and mutation replay. Tests outside the feat(auth): emit structured gateway authentication and authorization events #2912 work keep their own fixtures.

Testing

• cargo nextest run -p openshell-server -p openshell-ocsf --features openshell-ocsf/test-support: all 2,613 tests pass.
• cargo clippy -p openshell-server --all-targets -- -D warnings
• Reviewed each converted assertion against the original; none was dropped or weakened.
• E2E tests added or updated: not applicable.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[TaylorMutch]

Reviewed the complete incremental diff at 1798f48 against #4777. No actionable findings. Shared capture and principal fixtures preserve the original values and assertions while strengthening OCSF schema and finding validation. Required CI gates pass. Validation relied on static review and CI; no local tests run.