Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

tests/test_docs_publishable.py

@@ -21,6 +21,17 @@ import pytest
 REPO = Path(__file__).resolve().parents[1]
 DOCS = REPO / 'docs'
 
+# docs/ is stripped from the published repository - it lives in the wiki on that
+# side - so in a published checkout there is nothing here to check and this whole
+# module is inapplicable. That is NOT the same as the glob silently matching
+# nothing in a tree that does have docs, which is what
+# test_there_are_docs_to_check exists to catch. Distinguishing the two matters:
+# collapsing them either breaks CI on the published mirror (this module failed
+# there for exactly this reason) or quietly disables the guard everywhere.
+pytestmark = pytest.mark.skipif(
+    not DOCS.is_dir(),
+    reason='no docs/ in this checkout - it is excluded from publication and lives in the wiki')
+
 # Kept in step with the scrub list in tools/export-github.sh. Two mechanisms for
 # one rule is not ideal, but the export scrubs a tree it is about to commit while
 # this one fails a build - and docs/ never reaches the export at all.