test(drivers): drop SSH handshake secret negative-assertion tests

The supporting code, env vars, CLI flags, and config plumbing are
gone — these tests asserted absence of strings that no longer have
any path to being set. Remove the guards from the Docker, Podman,
Kubernetes, and VM driver test modules.

Author: TaylorMutch

crates/openshell-driver-docker/src/tests.rs

@@ -395,14 +395,6 @@ fn build_environment_sets_docker_tls_paths() {
     assert!(env.contains(&"TEMPLATE_ENV=template".to_string()));
     assert!(env.contains(&"SPEC_ENV=spec".to_string()));
     assert!(env.contains(&"OPENSHELL_SANDBOX_COMMAND=sleep infinity".to_string()));
-    assert!(
-        !env.iter()
-            .any(|entry| entry.starts_with("OPENSHELL_SSH_HANDSHAKE_SECRET="))
-    );
-    assert!(
-        !env.iter()
-            .any(|entry| entry.starts_with("OPENSHELL_SSH_HANDSHAKE_SKEW_SECS="))
-    );
 }
 
 #[test]

crates/openshell-driver-kubernetes/src/driver.rs

@@ -1503,30 +1503,6 @@ mod tests {
     use super::*;
     use prost_types::{Struct, Value, value::Kind};
 
-    #[test]
-    fn apply_required_env_does_not_inject_handshake_env() {
-        let mut env = Vec::new();
-        apply_required_env(
-            &mut env,
-            "sandbox-1",
-            "my-sandbox",
-            "https://endpoint:8080",
-            "0.0.0.0:2222",
-            true,
-        );
-
-        for name in [
-            "OPENSHELL_SSH_HANDSHAKE_SECRET",
-            "OPENSHELL_SSH_HANDSHAKE_SKEW_SECS",
-        ] {
-            assert!(
-                !env.iter()
-                    .any(|e| e.get("name").and_then(|v| v.as_str()) == Some(name)),
-                "{name} must not appear in sandbox pod env after handshake-secret removal"
-            );
-        }
-    }
-
     #[test]
     fn supervisor_sideload_injects_run_as_user_zero() {
         let mut pod_template = serde_json::json!({

crates/openshell-driver-podman/src/container.rs

@@ -813,32 +813,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn container_spec_does_not_inject_handshake_env() {
-        let sandbox = test_sandbox("test-id", "test-name");
-        let config = test_config();
-        let spec = build_container_spec(&sandbox, &config);
-
-        let env_map = spec["env"].as_object().expect("env should be an object");
-        for name in [
-            "OPENSHELL_SSH_HANDSHAKE_SECRET",
-            "OPENSHELL_SSH_HANDSHAKE_SKEW_SECS",
-        ] {
-            assert!(
-                !env_map.contains_key(name),
-                "{name} must not appear in container env"
-            );
-        }
-
-        let secret_env = spec["secret_env"]
-            .as_object()
-            .expect("secret_env should be an object");
-        assert!(
-            !secret_env.contains_key("OPENSHELL_SSH_HANDSHAKE_SECRET"),
-            "handshake secret must not appear in secret_env"
-        );
-    }
-
     #[test]
     fn container_spec_sets_sandbox_name_in_env() {
         let sandbox = test_sandbox("test-id", "my-sandbox");

crates/openshell-driver-vm/src/driver.rs

@@ -2817,11 +2817,6 @@ mod tests {
         assert!(env.contains(&format!(
             "OPENSHELL_SSH_SOCKET_PATH={GUEST_SSH_SOCKET_PATH}"
         )));
-        assert!(
-            !env.iter()
-                .any(|e| e.starts_with("OPENSHELL_SSH_HANDSHAKE_SECRET=")),
-            "SSH handshake secret must not be injected into guest env"
-        );
     }
 
     #[test]