test(scripts): cover branch-aware _should_sync in sync-plugin-versions

PR #484 added branch-awareness to ``scripts/sync-plugin-versions.py``
(no-op on feature branches unless ``HEADROOM_SYNC_VERSIONS=1``). The
existing ``test_main_runs_plugin_only_version_sync`` test broke
because it didn't account for the new ``_should_sync`` gate — on a
feature branch the main() function early-returns and the subprocess
mock was never invoked, but actually the test broke earlier because
``_current_branch`` calls ``subprocess.run(..., capture_output=True,
text=True, check=False)`` and the test's lambda only accepted
``(command, cwd, check)``.

Fix: force ``_should_sync`` True in the existing test so it locks
the run-path, then add 4 new tests covering the branch-aware logic
itself (env override, main vs feature, git-unavailable defensive
no-op).

scripts/tests/test_sync_plugin_versions.py

@@ -43,10 +43,13 @@ def test_compute_repo_semver_uses_release_helpers(monkeypatch) -> None:
 
 
 def test_main_runs_plugin_only_version_sync(monkeypatch) -> None:
+    """Locks the sync-execution path. ``_should_sync`` is forced True so
+    we don't depend on the test machine's git branch context."""
     module = _load_module()
     commands: list[list[str]] = []
 
     monkeypatch.setattr(module, "compute_repo_semver", lambda root: "0.10.0")
+    monkeypatch.setattr(module, "_should_sync", lambda root: True)
     monkeypatch.setattr(
         module.subprocess,
         "run",
@@ -66,3 +69,63 @@ def test_main_runs_plugin_only_version_sync(monkeypatch) -> None:
             "--plugin-manifests-only",
         ]
     ]
+
+
+def test_main_is_noop_on_feature_branch(monkeypatch, capsys) -> None:
+    """Locks the branch-aware contract: when ``_should_sync`` returns
+    False (feature branch, no HEADROOM_SYNC_VERSIONS opt-in), main()
+    prints a skip line and returns without invoking the version-sync
+    subprocess. Pre-this-fix the hook bumped manifests on every commit
+    regardless of branch — leaking version-bump noise into every PR."""
+    module = _load_module()
+    commands: list[list[str]] = []
+
+    monkeypatch.setattr(module, "_should_sync", lambda root: False)
+    monkeypatch.setattr(module, "_current_branch", lambda root: "feature/foo")
+    monkeypatch.setattr(
+        module.subprocess,
+        "run",
+        lambda *args, **kwargs: commands.append(args),
+    )
+
+    module.main()
+
+    assert commands == [], "Subprocess must not run when _should_sync returns False"
+    captured = capsys.readouterr()
+    assert "skipping on branch 'feature/foo'" in captured.out
+
+
+def test_should_sync_honours_env_override(monkeypatch) -> None:
+    """``HEADROOM_SYNC_VERSIONS=1`` forces a sync even on feature
+    branches — the release workflow uses this opt-in so the canonical
+    manifest sync still happens at publish time."""
+    module = _load_module()
+    monkeypatch.setenv("HEADROOM_SYNC_VERSIONS", "1")
+    # Even on a "feature" branch, env override wins.
+    monkeypatch.setattr(module, "_current_branch", lambda root: "feature/foo")
+    assert module._should_sync(Path("ignored")) is True
+
+
+def test_should_sync_main_branch_runs(monkeypatch) -> None:
+    """On ``main``, sync runs without needing the env var."""
+    module = _load_module()
+    monkeypatch.delenv("HEADROOM_SYNC_VERSIONS", raising=False)
+    monkeypatch.setattr(module, "_current_branch", lambda root: "main")
+    assert module._should_sync(Path("ignored")) is True
+
+
+def test_should_sync_feature_branch_is_skip(monkeypatch) -> None:
+    """On any non-main branch without the env var, sync is a no-op."""
+    module = _load_module()
+    monkeypatch.delenv("HEADROOM_SYNC_VERSIONS", raising=False)
+    monkeypatch.setattr(module, "_current_branch", lambda root: "fix/some-bug")
+    assert module._should_sync(Path("ignored")) is False
+
+
+def test_should_sync_returns_false_when_git_unavailable(monkeypatch) -> None:
+    """Defensive: if ``_current_branch`` returns None (git not on
+    PATH, detached HEAD, etc.) the safe default is no-op."""
+    module = _load_module()
+    monkeypatch.delenv("HEADROOM_SYNC_VERSIONS", raising=False)
+    monkeypatch.setattr(module, "_current_branch", lambda root: None)
+    assert module._should_sync(Path("ignored")) is False