fix(agent): give ansible a blocking stdin boundary

apps/api/src/services/awooop_ansible_check_mode_service.py

@@ -623,6 +623,7 @@ async def _run_ansible_command(spec: AnsibleCommandSpec, *, timeout_seconds: int
         *spec.command,
         cwd=str(spec.cwd),
         env=spec.env,
+        stdin=asyncio.subprocess.DEVNULL,
         stdout=asyncio.subprocess.PIPE,
         stderr=asyncio.subprocess.PIPE,
     )

apps/api/tests/test_awooop_truth_chain_service.py

@@ -2660,6 +2660,7 @@ async def test_controlled_apply_duplicate_never_runs_subprocess(
 def test_ansible_subprocess_is_terminated_when_worker_task_is_cancelled() -> None:
     source = inspect.getsource(_run_ansible_command)
 
+    assert "stdin=asyncio.subprocess.DEVNULL" in source
     assert "except asyncio.CancelledError" in source
     assert "process.kill()" in source
     assert "await process.communicate()" in source