test(infra): provision complete trust for pin rollback regression

Use the existing synthetic authority fixture so the test reaches the injected replacement failure, and assert that the failure hook ran before checking every original file was restored. Keep runtime trust requirements unchanged.

yuqei-infra/tests/test_rc06_release_trust_bootstrap.py

@@ -1186,28 +1186,7 @@ def test_pin_apply_rolls_back_completed_files_when_later_replace_fails(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    state, _result, _keys = _initialize(tmp_path)
-    reviewer_file = tmp_path / "reviewer-registration.json"
-    _reviewer_registration(reviewer_file)
-    recovery = authority.build_recovery_keyrings(
-        state,
-        reviewer_file,
-        epoch=1,
-        unprotect=_unprotect,
-        now=datetime(2026, 9, 27, 2, 0, tzinfo=UTC),
-    )
-    repo = _copy_pin_sources(tmp_path)
-    online_registration_file = tmp_path / "online-service-registration.json"
-    _online_service_registration(online_registration_file)
-    plan = authority.plan_pin_updates(
-        repo,
-        state,
-        Path(recovery["directory"]),
-        epoch=1,
-        unprotect=_unprotect,
-        online_service_registration_file=online_registration_file,
-        online_environment_ids=("isolated-uat-fixture",),
-    )
+    _, _, plan = _pin_plan_fixture(tmp_path)
     real_replace = authority._write_bound_source_replacement
     calls = 0
 
@@ -1221,6 +1200,7 @@ def test_pin_apply_rolls_back_completed_files_when_later_replace_fails(
     monkeypatch.setattr(authority, "_write_bound_source_replacement", fail_second)
     with pytest.raises(authority.AuthorityError, match="transaction failed"):
         authority.apply_pin_plan(plan)
+    assert calls >= 2
     assert all(change.path.read_bytes() == change.original for change in plan.changes)