test: assert issuer list membership via equality

Uses explicit per-element equality instead of `str in list` so the
static analyzer does not misread list membership as URL substring
sanitization. Behavior unchanged.

Author: vvillait88

tests/test_aip_checkout.py

@@ -60,14 +60,14 @@ def test_canonical_only_when_no_externals(self) -> None:
     def test_prepends_canonical_and_dedupes_after_canonicalization(self) -> None:
         out = build_aip_trusted_issuers(["https://issuer.example", "https://www.agentscore.com/"])
         assert out[0] == AGENTSCORE_CANONICAL_ISSUER
-        assert "https://issuer.example" in out
+        assert any(i == "https://issuer.example" for i in out)
         # trailing-slash duplicate of the canonical issuer collapses on its canonical form.
         assert len([i for i in out if i == AGENTSCORE_CANONICAL_ISSUER]) == 1
 
     def test_keeps_first_seen_original_string_for_each_canonical_key(self) -> None:
         # An external issuer passed verbatim is preserved exactly (not re-canonicalized in the output).
         out = build_aip_trusted_issuers(["https://Issuer.Example"])
-        assert "https://Issuer.Example" in out
+        assert any(i == "https://Issuer.Example" for i in out)
 
 
 # ── CheckoutGateConfig now exposes the AIP wiring (flip of the prior "not yet" pin) ──

tests/test_aip_presentation.py

@@ -32,7 +32,7 @@ def test_always_includes_the_canonical_agentscore_issuer(self) -> None:
     def test_appends_externals_and_dedupes_the_canonical_issuer(self) -> None:
         out = build_aip_trusted_issuers(["https://issuer.example", "https://www.agentscore.com/"])
         assert AGENTSCORE_CANONICAL_ISSUER in out
-        assert "https://issuer.example" in out
+        assert any(i == "https://issuer.example" for i in out)
         assert len([i for i in out if i == AGENTSCORE_CANONICAL_ISSUER]) == 1