test(inventory): make mixed-format fixture deterministic

[mldangelo-oai]

The latest Nightly CI run failed the Windows Python 3.11 asset-inventory test because random SafeTensors data selected pickle-overlap routing, while the test expected SafeTensors metadata.

Use fixed zero-filled tensors in the shared mixed-format fixture and keep the nested tensor file under tmp_path. The existing assertions still check the nested format, tensor names, and pickle warning. Scanner behavior is unchanged.

Validation:

• Reproduced the exact original pickle != safetensors assertion by supplying RandomState(230).randn as the fixture's random source; the same invocation passes after this change.
• Asset-inventory integration file: 12 passed on Python 3.11 with the lightweight Nightly dependency profile.
• Repository ruff lint and format checks passed; Linux-platform mypy passed (479 files).
• Native macOS mypy reports five baseline extended-attribute typing errors in unchanged CLI code/tests.
• Broad fast suite interrupted after 15,201 passed, 512 skipped, and five failures. All five failing nodes reproduce with this change removed: macOS ACL symbol lookup, descriptor-bound shard pinning, and a shard-related SafeTensors assertion. Full suite completion and native Windows validation remain for CI.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T23:47:49.862934Z	b8c450e	Manual request
🔒 Security Review	✅ Completed 2026-09-03T23:50:20.452731Z	b8c450e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: b8c450e443

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: b8c450e443

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.