fix(tests): align stale tests with current behavior

- swarm/test_swarm_api, swarm/test_heartbeat: replace deprecated
  asyncio.get_event_loop().run_until_complete() with asyncio.run();
  the former raises in 3.11 once another test has set+closed a loop on
  the main thread.
- prober/test_prober_bus, prober/test_prober_worker: extend tcp_fingerprint
  mocks with tos/dscp/ecn/server_isn so the worker doesn't KeyError into
  the prober_error branch.
- services/test_service_isolation: collector now retries on event-stream
  errors instead of exiting; assert it stays running and cancel cleanly.
- live/test_imap_live, live/test_pop3_live: log format emits
  outcome="failure", not "failed".
- live/test_service_isolation_live: is_service_container accepts label
  OR state-name; rewrite the empty-state test against a synthetic
  unlabeled container instead of the host's real fleet.

tests/live/test_imap_live.py

@@ -60,7 +60,7 @@ class TestIMAPLive:
             pass
         lines += drain()
         matched = assert_rfc5424(lines, service="imap", event_type="auth")
-        assert "failed" in matched, f"Expected auth failure in log. Got:\n{matched!r}"
+        assert "failure" in matched, f"Expected auth failure in log. Got:\n{matched!r}"
 
     def test_select_inbox_after_login(self, live_service):
         port, drain = live_service("imap")

tests/live/test_pop3_live.py

@@ -55,4 +55,4 @@ class TestPOP3Live:
             pass
         lines += drain()
         matched = assert_rfc5424(lines, service="pop3", event_type="auth")
-        assert "failed" in matched, f"Expected auth failure in log. Got:\n{matched!r}"
+        assert "failure" in matched, f"Expected auth failure in log. Got:\n{matched!r}"

tests/live/test_service_isolation_live.py

@@ -137,29 +137,31 @@ class TestCollectorLiveIsolation:
     """Real collector behaviour against the actual Docker daemon."""
 
     async def test_collector_finds_no_deckies_without_state(self, tmp_path):
-        """With no deckies in state, collector's container scan finds nothing.
+        """With no deckies in state and no DECNET labels, the scan rejects
+        every container.
 
-        We avoid calling the full worker because client.events() blocks
-        the thread indefinitely — instead we test the scan logic directly
-        against the real Docker daemon.
+        is_service_container has two acceptance paths:
+          1. label-based (decnet.fleet.service / decnet.topology.service)
+          2. name match against decnet-state.json
+
+        With state empty AND labels absent, both paths must reject.  We
+        feed synthetic container objects (no real Docker call) so the
+        result is independent of whatever fleet may already be running on
+        the host — which would otherwise satisfy path (1).
         """
-        import docker
         import decnet.config as cfg
+        from unittest.mock import MagicMock
 
         original_state = cfg.STATE_FILE
         try:
             cfg.STATE_FILE = tmp_path / "empty-state.json"
 
-            # Real Docker client, real container list — but no state means
-            # is_service_container rejects everything.
-            client = docker.from_env()
-            matched = [c for c in client.containers.list() if is_service_container(c)]
-            client.close()
+            unlabeled = MagicMock()
+            unlabeled.name = "some-random-container"
+            unlabeled.attrs = {"Config": {"Labels": {}}}
+            unlabeled.labels = {}
 
-            assert matched == [], (
-                f"Expected no matching containers without state, got: "
-                f"{[c.name for c in matched]}"
-            )
+            assert is_service_container(unlabeled) is False
         finally:
             cfg.STATE_FILE = original_state