feat(admin-config-tool): task 5.4 - golden-file build determinism tests

tests/fixtures/{minimal,full}/configs/*.yaml + checked-in expected.bin
golden files, added to test_config_build.py. Catches representation
drift (bytes changing even when decoded content stays correct) that
the existing structural/decode-based assertions can't detect.

src/xceadmin/tests/test_config_build.py

@@ -1,6 +1,15 @@
 """Golden-file-style build tests for ``xceadmin.build`` (design.md,
-``xceadmin.build``; Requirements 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.9,
-8.3, 8.4).
+``xceadmin.build``; Requirements 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8,
+1.9, 1.10, 1.11, 1.12, 8.3, 8.4, 9.1, 9.2, 9.3).
+
+The ``tests/fixtures/minimal`` and ``tests/fixtures/full`` directories
+(task 5.4) each pair a real, schema-valid ``configs/`` input with a
+checked-in ``expected.bin`` -- unlike the dynamic build-then-compare
+tests elsewhere in this file, these catch *unintended representation
+drift*: a future change that is semantically correct (decodes fine,
+right field values) but produces different serialized bytes than
+before would still be a determinism regression (Requirement 9) that
+purely structural assertions would never notice.
 """
 
 from __future__ import annotations
@@ -259,3 +268,52 @@ def test_write_output_does_not_print_the_hash_itself(tmp_path, capsys):
 
     captured = capsys.readouterr()
     assert captured.err == ""
+
+
+# ---------------------------------------------------------------------------
+# Golden-file determinism (task 5.4)
+# ---------------------------------------------------------------------------
+
+FIXTURES_DIR = Path(__file__).resolve().parent / "fixtures"
+
+
+@pytest.mark.parametrize("fixture_name", ["minimal", "full"])
+def test_golden_fixture_matches_checked_in_expected_bin(fixture_name):
+    fixture_dir = FIXTURES_DIR / fixture_name
+    data = build.build_cluster_config(str(fixture_dir / "configs"))
+    expected = (fixture_dir / "expected.bin").read_bytes()
+
+    assert data == expected
+
+
+@pytest.mark.parametrize("fixture_name", ["minimal", "full"])
+def test_golden_fixture_builds_twice_identically(fixture_name):
+    fixture_dir = FIXTURES_DIR / fixture_name / "configs"
+
+    first = build.build_cluster_config(str(fixture_dir))
+    second = build.build_cluster_config(str(fixture_dir))
+
+    assert first == second
+    assert hashlib.sha256(first).hexdigest() == hashlib.sha256(second).hexdigest()
+
+
+def test_full_golden_fixture_covers_all_seven_file_types():
+    fixture_dir = FIXTURES_DIR / "full" / "configs"
+    present = {p.name for p in fixture_dir.glob("*.yaml")}
+
+    assert present == {
+        "hosts.yaml",
+        "queues.yaml",
+        "resources.yaml",
+        "users.yaml",
+        "limits.yaml",
+        "xce.yaml",
+        "scaler.yaml",
+    }
+
+
+def test_minimal_golden_fixture_covers_hosts_and_queues_only():
+    fixture_dir = FIXTURES_DIR / "minimal" / "configs"
+    present = {p.name for p in fixture_dir.glob("*.yaml")}
+
+    assert present == {"hosts.yaml", "queues.yaml"}