[AZ-557] Leftover: Cycle2HotfixDeployTests FindRepoRoot pre-existing

Record the 6 pre-existing Cycle2HotfixDeployTests failures introduced
by batch 5 (commit f369153) as a leftover for the cycle-2
retrospective. Root cause: FindRepoRoot walks up from
AppContext.BaseDirectory looking for .env.example, but the
e2e-consumer container does not mount the repo root.

Batch-6 (AZ-556/AZ-557) tests are green; this leftover is unrelated
to the auth-surface chain.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/_process_leftovers/2026-05-14_cycle2hotfix_deploy_tests_findreporoot.md

@@ -0,0 +1,61 @@
+# Leftover — Cycle2HotfixDeployTests `FindRepoRoot()` failures in docker-test
+
+**Timestamp**: 2026-05-14T08:58:00+02:00
+**Category**: pre-existing test-environment defect (NOT a batch-6 regression)
+**Surfaced by**: full E2E run at end of batch 6 (commits `4bf2e68` + `5224a12`)
+
+## What is failing
+
+Six tests in `e2e/Azaion.E2E/Tests/Cycle2HotfixDeployTests.cs` throw
+`System.InvalidOperationException: Repo root not found from test base directory`:
+
+- `AZ552_AC4_No_jwtconfig_secret_references_in_scripts_or_env_example`
+- `AZ553_AC5_Env_example_documents_deploy_host_jwt_keys_dir`
+- `AZ555_AC1_No_jwtconfig_secret_in_secrets_readme`
+- `AZ555_AC2_Readme_documents_new_env_vars`
+- `AZ555_AC3_Readme_and_env_example_are_consistent`
+- `AZ555_AC4_Readme_documents_host_side_ownership_guidance`
+
+## Root cause (single-line probe; not a fix)
+
+`Cycle2HotfixDeployTests.FindRepoRoot()` walks up from
+`AppContext.BaseDirectory` looking for `.env.example`. Inside the
+`e2e-consumer` container, `AppContext.BaseDirectory` is something like
+`/src/Azaion.E2E/bin/Debug/net10.0/`. The container's volume mounts
+(`docker-compose.test.yml` `e2e-consumer.volumes`) only include
+`./e2e/test-results` and `./e2e/test-keys` — `.env.example` and the
+deploy chain (`scripts/`, `secrets/`, `env/`) are NOT mounted, so the
+walk runs out at `/` without ever finding the marker.
+
+The tests were authored alongside batch 5 (`f369153 [AZ-552..AZ-555]`)
+and assume local-dev execution. They were never green under
+`scripts/run-tests.sh` (which is docker-only) — but the batch-5 commit
+appears to have shipped without that being caught.
+
+## Why this is not part of batch 6
+
+AZ-556 + AZ-557 (batch 6) touch only the auth surface (login error
+codes, MFA lockout pipeline). None of the failing tests depend on or
+exercise code my commits modified. The 6 failures were present at the
+batch-5 commit; my commits did not introduce them. Per the `coderule`
+"pre-existing failures in unrelated areas" clause, these are reported
+but not blocking the batch-6 close-out.
+
+## Suggested remediations (pick one)
+
+- **A — Mount the repo into the e2e-consumer container**: add `.:/repo:ro`
+  to `docker-compose.test.yml` `e2e-consumer.volumes` and change
+  `FindRepoRoot()` to honour an env var (`REPO_ROOT`, default `/repo`)
+  set in the same compose service. Smallest change, makes the static
+  repo grep meaningful inside docker too.
+- **B — Skip in docker, run as `[Fact(Skip="docker-test does not mount repo root; verified by code review")]`**: matches the precedent the same file already uses for preflight ACs.
+- **C — Move these checks into the build pipeline (CI lint job)**: they
+  are static repo grep / consistency checks, not runtime behaviour. They
+  belong in a pre-test lint stage, not in xUnit at all.
+
+## Status
+
+- Reported in the cycle-2 hotfix sprint final implementation report.
+- Will surface in the cycle-2 retrospective for an explicit decision.
+- Until then, the suite is "green for tests covering modified code; 6
+  pre-existing deploy-static-check failures unresolved".