fix(tests): make webhook SSRF test clean-worktree deterministic

Test-only fix continuing #2523. Makes the webhook SSRF test deterministic in clean worktrees without creating ./data or repo-local DB artifacts.

tests/test_webhook_ssrf_resilience.py

@@ -1,15 +1,27 @@
+import os
 import sys
 import json
 from datetime import datetime
+from unittest.mock import patch
 
 import pytest
 
 from tests.helpers.import_state import clear_module, preserve_import_state
 
 # conftest.py stubs src.database; drop the stub so webhook_manager imports the
-# real module. preserve_import_state restores both sys.modules and the parent
+# real module. preserve_import_state restores sys.modules and parent-package
-# src.database attribute after the block, preventing stub leakage into siblings.
+# attributes for both src.database and core.database after the block, preventing
-with preserve_import_state("src.database"):
+# stub/engine leakage into siblings.
+#
+# Importing the real core.database runs init_db() -> create_all() against
+# DATABASE_URL (default sqlite:///./data/app.db); in a clean worktree with no
+# ./data directory that raises sqlite3.OperationalError during collection. Pin
+# DATABASE_URL to in-memory SQLite for the import: it needs no filesystem path
+# and leaves no artifact, and these tests never touch the real engine
+# (validate_webhook_url is pure; the delivery test monkeypatches SessionLocal).
+# patch.dict restores the prior DATABASE_URL after the block.
+with patch.dict(os.environ, {"DATABASE_URL": "sqlite:///:memory:"}), \
+        preserve_import_state("src.database", "core.database"):
     clear_module("src.database")
     _core_database = sys.modules.get("core.database")
     _core_database_all = (