test(tf): lock the offsite_hosts inventory handoff

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_tf_to_inventory.py

@@ -0,0 +1,30 @@
+import json
+import pathlib
+import subprocess
+import sys
+
+_SCRIPT = pathlib.Path(__file__).resolve().parent.parent / "scripts" / "tf_to_inventory.py"
+
+
+def _run(tf_output: dict) -> str:
+    return subprocess.run(
+        [sys.executable, str(_SCRIPT)],
+        input=json.dumps(tf_output), capture_output=True, text=True, check=True,
+    ).stdout
+
+
+def test_offsite_host_lands_in_offsite_hosts():
+    out = _run({"vms": {"value": {"askari": {"ip": "203.0.113.7", "group": "offsite_hosts"}}}})
+    assert "offsite_hosts:" in out
+    assert "askari:" in out
+    assert "ansible_host: 203.0.113.7" in out
+
+
+def test_unknown_group_rejected():
+    proc = subprocess.run(
+        [sys.executable, str(_SCRIPT)],
+        input=json.dumps({"vms": {"value": {"x": {"ip": "1.2.3.4", "group": "nope"}}}}),
+        capture_output=True, text=True,
+    )
+    assert proc.returncode == 1
+    assert "unknown group" in proc.stderr