cve: actually test the narrowing — the previous commit shipped it uncovered

Disabling the filter left all twenty-two assertions green, which means nothing
tested it. The counter-case I had written exercises the skip in the derivation,
not the filter inside the registry selection, so the feature went out with no
coverage at all — the project's own favourite failure, in the change that was
meant to remove noise.

Three assertions now cover it: three repositories of which one runs, the
counter-case showing the same call returns all three without estate knowledge,
and one that pins what the rule must not do — it excludes repositories, not old
tags, so a rollback target of a running service still counts.

Same sabotage as before now turns one of them red.

monitoring/cve/test_targets.py

@@ -184,6 +184,39 @@ class RegistryAuswahl(unittest.TestCase):
         ziele = targets.ziele_registry("reg.example", je_repo=5)
         self.assertEqual(ziele, {"reg.example/sorb/x:v1.0.0"})
 
+    def _stelle_repos(self, repos):
+        targets.registry_repos = lambda reg, timeout=15.0: repos
+        targets.registry_tags = lambda reg, repo, token="", timeout=15.0: ["v1.0.0"]
+        targets.tag_erstellt = lambda reg, repo, tag, token="", timeout=15.0: ts(2026, 5, 1)
+
+    def test_nur_repos_mit_laufendem_tag_zaehlen(self):
+        # ⚠️ Der Kern der Einengung (#0051): Von drei Repos laeuft nur eines.
+        # element-desktop-build und windows-vm sind Bau-Artefakte und trugen
+        # zusammen 61 CRITICAL, davon 1 behebbar.
+        self._stelle_repos(["sorb/threadnet-web", "sorb/element-desktop-build", "sorb/windows-vm"])
+        laufend = {"reg.example/sorb/threadnet-web:v0.6.0"}
+        ziele = targets.ziele_registry("reg.example", je_repo=3, laufend=laufend)
+        self.assertEqual(ziele, {"reg.example/sorb/threadnet-web:v1.0.0"})
+
+    def test_gegenprobe_ohne_einengung_kaemen_die_bau_artefakte_mit(self):
+        # Belegt, dass der Test darueber ueberhaupt etwas prueft: ohne
+        # Bestandswissen liefert dieselbe Funktion alle drei Repos.
+        self._stelle_repos(["sorb/threadnet-web", "sorb/element-desktop-build", "sorb/windows-vm"])
+        ziele = targets.ziele_registry("reg.example", je_repo=3, laufend=None)
+        self.assertEqual(len(ziele), 3)
+        self.assertIn("reg.example/sorb/windows-vm:v1.0.0", ziele)
+
+    def test_einengung_trifft_nur_das_repo_nicht_den_tag(self):
+        # Laeuft v0.6.0, ist v0.5.4 trotzdem ein gueltiges Rollback-Ziel -
+        # die Einengung schliesst REPOS aus, nicht alte Fassungen.
+        targets.registry_repos = lambda reg, timeout=15.0: ["sorb/threadnet-web"]
+        targets.registry_tags = lambda reg, repo, token="", timeout=15.0: ["v0.6.0", "v0.5.4"]
+        targets.tag_erstellt = lambda reg, repo, tag, token="", timeout=15.0: (
+            ts(2026, 8, 19) if tag == "v0.6.0" else ts(2026, 8, 17))
+        laufend = {"reg.example/sorb/threadnet-web:v0.6.0"}
+        ziele = targets.ziele_registry("reg.example", je_repo=3, laufend=laufend)
+        self.assertIn("reg.example/sorb/threadnet-web:v0.5.4", ziele)
+
     def test_tag_ohne_zeitstempel_wird_uebersprungen_nicht_geraten(self):
         tags = ["v1.0.0", "v2.0.0"]
         zeiten = {"v1.0.0": ts(2026, 5, 10)}      # v2.0.0 liefert None