test(real-infra): fail instead of skipping when read-only role provisioning errors #85

Context

Follow-up from #84. The readonly_engine fixture in tests/real/test_sql_isolation_real.py treats every exception from provision_readonly_role() as "environment unavailable":

try:
    await provision_readonly_role(real_database_url, url)
except Exception as exc:  # pragma: no cover - environment-dependent
    pytest.skip(f"Could not provision the read-only role: {exc}")

A regression in the security-critical provisioner (for example, a REVOKE/GRANT that stops working) would therefore turn most of the SQL-isolation live tests green-by-skip, hiding the failure.

test_reused_role_has_its_privileges_stripped does not use this fixture and would still fail, which limits the blast radius, but the fixture should not mask provisioning errors.

Acceptance criteria

• Skip only for genuinely environmental causes (feature flag off, database unreachable / authentication failure).
• For ReadonlyRoleConfigError and unexpected exceptions, call pytest.fail with the original traceback so CI goes red.
• Add a unit test for the classification helper (or otherwise prove the skip is narrow).