test(cli): stop the telemetry report tests passing vacuously

Version is "dev" in a test binary, and a dev build has telemetry switched off
entirely, so reportCommand returned at its first line in both tests that
exercise it. They asserted that no child process was started, which was true
for a reason that had nothing to do with the code under test: they would have
passed just as well with the opt-out gate and the unresolved-command filter
both deleted.

The tests now make the binary look like a released one for their duration. A
positive case comes with them, asserting that a resolved command with telemetry
on really does start a child, so that a reportCommand which returned early for
every input can no longer satisfy the pair.

Verified by mutation: removing either the opt-out gate or the empty-command
filter now fails the corresponding test, where before it did not.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 2dd3f4ba-458a-4d2b-8f0b-eb8f7804f4d0

Author: migmartri

app/cli/cmd/telemetry_spawn_test.go

@@ -73,6 +73,18 @@ func assertNoChildOutput(t *testing.T, path, msg string) {
 	assert.True(t, os.IsNotExist(err), msg)
 }
 
+// withReleaseVersion makes the binary look like a released one for the duration of a test.
+// Version is "dev" by default, and a dev build has telemetry switched off entirely, so
+// without this every test of reportCommand would return at the first line and pass no
+// matter what the code under it did.
+func withReleaseVersion(t *testing.T) {
+	t.Helper()
+
+	original := Version
+	Version = "v1.2.3"
+	t.Cleanup(func() { Version = original })
+}
+
 // TestSpawnTelemetryFlushDeliversThePayload covers the process boundary itself: what the
 // parent writes is what the child reads on its stdin.
 func TestSpawnTelemetryFlushDeliversThePayload(t *testing.T) {
@@ -173,6 +185,7 @@ func TestReportCommandIsSilentWhenTelemetryIsDisabled(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
+			withReleaseVersion(t)
 			t.Setenv(doNotTrackEnv, tc.value)
 			out := stubFlushCommand(t, `cat > "$1"`)
 
@@ -187,10 +200,24 @@ func TestReportCommandIsSilentWhenTelemetryIsDisabled(t *testing.T) {
 // subcommands, where cobra hands back the root command and there is no command path to
 // report.
 func TestReportCommandSkipsUnresolvedCommands(t *testing.T) {
+	withReleaseVersion(t)
 	t.Setenv(doNotTrackEnv, "")
 	out := stubFlushCommand(t, `cat > "$1"`)
 
 	reportCommand(newTestRootCommand(), time.Second, nil)
 
 	assertNoChildOutput(t, out, "the root command has no command path and must not be reported")
 }
+
+// TestReportCommandSpawnsForARealCommand is the positive case the two tests above are only
+// meaningful against: with telemetry on and a resolved command, a child really is started.
+// Without it, a reportCommand that returned early for every input would satisfy them both.
+func TestReportCommandSpawnsForARealCommand(t *testing.T) {
+	withReleaseVersion(t)
+	t.Setenv(doNotTrackEnv, "")
+	out := stubFlushCommand(t, `cat > "$1"`)
+
+	reportCommand(newReportableCommand(), 1500*time.Millisecond, nil)
+
+	assert.Contains(t, string(waitForFile(t, out)), `"duration_ms":1500`)
+}