feat(provenance): govern source snapshots and data inputs

backend/tests/conftest.py

@@ -0,0 +1,19 @@
+"""Canonical backend-test import boundary.
+
+Pytest is intentionally runnable from ``backend/`` because that is the CI
+entrypoint.  Some contract tests exercise repository-level deterministic
+scripts; put the canonical repository root ahead of the legacy
+``backend/scripts`` helper directory so those imports resolve to the code that
+is actually shipped by the root Docker build.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
+repository_root_text = str(REPOSITORY_ROOT)
+if repository_root_text not in sys.path:
+    sys.path.insert(0, repository_root_text)