test: address review feedback — fixture lifecycle, test names, ClassVar

- ci-fixture-plugin: call display_manager.clear() before rendering (per
  plugin guidelines — the fixture should model a well-behaved plugin),
  add a class docstring, and document why Pillow is deliberately not
  pinned in its requirements.txt (core dependency; harness installs
  nothing).
- Rename two tests whose names contradicted their assertions:
  test_unparseable_core_version_is_compatible ->
  test_unparseable_core_with_high_floor_is_blocked, and
  test_unreadable_secrets_file... -> test_corrupt_secrets_file...
- Annotate TestGetSchemaProperty.SCHEMA as ClassVar (RUF012).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh

test/test_config_manager_secrets.py

@@ -99,9 +99,9 @@ class TestSaveStripsSecrets:
         on_disk = json.loads((tmp_path / "config.json").read_text())
         assert on_disk == {"timezone": "UTC"}
 
-    def test_unreadable_secrets_file_writes_secrets_to_config_json(self, tmp_path):
+    def test_corrupt_secrets_file_writes_secrets_to_config_json(self, tmp_path):
         # SUSPECTED BUG (characterized, not fixed): when the secrets file is
-        # unreadable/corrupt at save time, save_config proceeds without
+        # corrupt (or otherwise unloadable) at save time, save_config proceeds without
         # stripping — writing the merged secrets into config.json in
         # plaintext. The code comments acknowledge the tradeoff (it prevents
         # data loss); this test pins the behavior so any future change to it