test(ci): preserve provenance and tighten guards

Keep no-lockfile dependency rechecks, cover both pip invocation forms, and remove an exact duplicate resolver test module with a tightened quality baseline.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: a939c5d6-bbbd-4fbb-8ec4-19feadc4479b

Author: danielmeppiel

CHANGELOG.md

@@ -31,10 +31,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - Release binaries no longer crash with missing Rich Unicode modules when
-  `apm deps list` renders non-ASCII package names. First-party CI and release
-  environments install exactly from `uv.lock`, repeated `apm runtime setup llm`
-  avoids double-injecting TLS trust into pip, and dependency resolution reuses
-  an existing package when no lockfile context requests a refresh. (#2264)
+  `apm deps list` renders non-ASCII package names. Repeated
+  `apm runtime setup llm` completes without TLS recursion, and first-party CI
+  and release environments resolve exactly from `uv.lock`. (#2264)
 - `apm uninstall` and `apm prune` no longer wipe still-installed dependencies'
   merged hook entries out of a harness (e.g. `.cursor/hooks.json`) that was
   dropped from a project's `targets:` list -- the hook wipe is now scoped to

src/apm_cli/core/_child_tls/_apm_tls_bootstrap.py

@@ -23,7 +23,12 @@ def _truthy(val):
 
 def _is_pip_process():
     """Let pip use its vendored truststore without a second SSL injection."""
-    return _os.path.basename(_sys.argv[0]).lower().startswith("pip")
+    if _os.path.basename(_sys.argv[0]).lower().startswith("pip"):
+        return True
+    original_args = getattr(_sys, "orig_argv", ())
+    return any(
+        original_args[index : index + 2] == ["-m", "pip"] for index in range(len(original_args) - 1)
+    )
 
 
 def _bootstrap():

src/apm_cli/deps/apm_resolver.py

@@ -969,9 +969,6 @@ def _should_force_recheck(self, dep_ref: DependencyReference) -> bool:
             if self._existing_lockfile is not None
             else None
         )
-        # `locked_dep is None` means "new dependency" only when a lockfile exists.
-        if self._existing_lockfile is None and not self._update_refs:
-            return False
         return should_force_ref_recheck(
             dep_ref,
             locked_dep,