acceptance: helper imports move the fingerprints, and the update test verifies a foreign signature

A test's fingerprint covered its own text and its module's shared text
only, so a judge imported from a sibling suite module (laser.py takes
its motion judges from motion.py) could change without moving the
fingerprints of the tests that call it. The shared text of every sibling
module a module imports now rides along, transitively; unit test.

update.slots-and-signature claimed to refuse a tampered signature but
fed fwup one garbage file. It now makes a throwaway key pair on the
machine, signs a tiny archive, checks that the archive verifies with its
own key and fails against the shipped release key, and asks the update
job to apply it without confirm_unsigned: the job refuses it for its
signature before touching the slot.

forgetest/tests/test_manifest.py

@@ -242,6 +242,28 @@ def two(ctx):
         self.assertNotEqual(a1, a2)
         self.assertNotEqual(b1, b2)
 
+    def test_a_helper_edit_in_an_imported_sibling_moves_the_tests(self):
+        # laser.py imports its judges from motion.py: an edit to such a
+        # helper changes the judge, so it has to move the fingerprints of
+        # the tests that import it, transitively.
+        sib = os.path.join(self.tmp, "judge.py")
+        with open(sib, "w", newline="\n") as f:
+            f.write("def judge(x):\n    return x > 1\n")
+        catalog._PARTS.pop(sib, None)
+        self.write("from .judge import judge\n" + self.MODULE)
+        a1, b1 = self.shas()
+        with open(sib, "w", newline="\n") as f:
+            f.write("def judge(x):\n    return x > 2\n")
+        catalog._PARTS.pop(sib, None)
+        a2, b2 = self.shas()
+        self.assertNotEqual(a1, a2)
+        self.assertNotEqual(b1, b2)
+        # a module that is not imported changes nothing
+        other = os.path.join(self.tmp, "other.py")
+        with open(other, "w", newline="\n") as f:
+            f.write("def o():\n    return 1\n")
+        self.assertEqual((a2, b2), self.shas())
+
     def test_line_endings_do_not_count(self):
         a1, b1 = self.shas()
         catalog._PARTS.pop(self.path, None)