tests: adopt the shared harness, split mega test files, remove process-global coupling

[jeremi]

Found during the 2026-07-07 architecture audit. This is the structural fix behind the flake cluster (#288, #295, #296).

Context

• Relay: 77 separate integration-test binaries, each linking the ~103k-LOC relay lib (compile/link multiplier), with NO shared common module; 17 files define their own write_config, 4 their own fixture(); admin_reload.rs (5,602 lines) defines ~25 local helpers (the file is deleted by refactor: replace TUF governed-config machinery with signed config bundles (verify at boot, restart to apply) #314; do not invest in consolidating it).
• Notary: one 14,831-line tests/standalone_http.rs (164 tests) next to a 21-line tests/common/mod.rs.
• registry-platform-testing (purpose-built MockIdp, MockHttpUpstream, audit-chain assertions, compile_error!-guarded) is used by ~5 files repo-wide. The shared harness exists and is ignored.
• Flake root causes are architectural, not test bugs: flaky test: relay serve_cli_preserves_config_flag_parsing races sibling tests on REGISTRY_RELAY_ENV_FILE #295 is confirmed process-global env coupling (main.rs:1976 falls back to REGISTRY_RELAY_ENV_FILE while sibling tests set_var/remove_var; ~70 direct env::var reads across api.rs/standalone.rs/main.rs), flaky test: notary-server antirollback_accept_and_publish_survives_dropped_join_handle fails under full-workspace parallel run #288 asserts an async task lifecycle by timing, flaky test: registryctl doctor_extracts_notary_diagnostics_as_product_findings fails intermittently in CI; assertion hides the report #296 is masked by assert!(report.ok) swallowing which check failed.

Scope

• Consolidate fixtures on registry-platform-testing (extend it where needed) and shared per-crate common modules.
• Split standalone_http.rs along the same seams as the api.rs split (refactor: split security-critical god files and make audit emission structural #304).
• Inject environment at construction instead of env::var reads at depth (fixes the flaky test: relay serve_cli_preserves_config_flag_parsing races sibling tests on REGISTRY_RELAY_ENV_FILE #295 class, not the instance).
• Make report assertions print the failing check.

Acceptance

• No integration test defines its own copy of config/fixture helpers that the shared harness provides.
• Flake tickets flaky test: notary-server antirollback_accept_and_publish_survives_dropped_join_handle fails under full-workspace parallel run #288/flaky test: relay serve_cli_preserves_config_flag_parsing races sibling tests on REGISTRY_RELAY_ENV_FILE #295/flaky test: registryctl doctor_extracts_notary_diagnostics_as_product_findings fails intermittently in CI; assertion hides the report #296 closed by root-cause fixes, not retries.