Narrow -fno-access-control and share the job-wrapping test helper #43

Problem

Ten test files (about 8.6k lines) compile with -fno-access-control, test_session.cpp for a single call, and the CMake reasons miss members reached. A helper that wraps the next audio job reaches four private layers, is copied three times and busy-spins without yielding.

Evidence

Checked against the code at e69f3b46a801:

• tests/CMakeLists.txt sets -fno-access-control on 10 files: test_dispatcher, test_noise_initiator, test_pairing_crypto, test_host_view, test_group_audio, test_session, test_server_core, test_session_driver, test_server_trust and test_audio_workers. Together they total 8592 lines, matching '~8.6k'.
• test_session.cpp is 1441 lines. Its only private-member use is Session::queue_json() at line 624. The CMake comment says so. queue_json() is declared private at src/session.h:398, while queue_json_message() (lines 646 and 1036) is public.
• test_server_trust.cpp mixes 3 black-box TEST(ServerTrust, ...) tests (lines 296, 337, 393) with 11 white-box TEST(ServerCoreTrust, ...) tests.
• The CMake reason comment for test_server_core.cpp names Group::audio_, Task::job_ and GroupAudio::instances_ but not ServerCore::groups_, Task::pool_ or Task::running_, which the code uses (about lines 534-545). The audio_workers comment omits Task::queued_ (line 262 and 366), Task::pool_ and Group::input_ (about line 408).
• docs/conventions.md line 79 requires a comment 'naming every member it reaches', so the omissions are a convention gap.
• The job-wrapping idiom (lock pool_->mutex, check running_/queued_, replace job_ with a lambda around the old job, then loop) appears 3 times: test_server_core.cpp about 536-555, test_audio_workers.cpp 259-273 and 363-377. The core copy also reaches into targetGroup::PipelineJob(). Each loop uses continue with no yield, so it spins.

Checked and not part of this issue

• Minor: the cited line ranges are approximate. The loops sit around test_audio_workers.cpp 259-273 and 363-377, and the Group::input_ read is near line 408 rather than 409. This does not change the substance.
• Minor: the spin is not a held-lock spin. The lock_guard is scoped per iteration, so continue releases the mutex. It is a lock/unlock busy loop with no yield, and the wait it covers is short.

Direction

Move white-box tests into small internals files, complete the reasons, and share one wrapping helper that yields.

Done when

• Fewer lines compile without access control; the helper exists once.