Zsh sandboxed startup: fixture rc files miss plugin manager PATH mutations during integration tests

Context

Teams adopting Zsh for scriptable integration tests often isolate runs with a temporary ZDOTDIR and zsh -f to avoid production credentials. The fixture .zshrc can stub secret-reading helpers and assert on exported variables, exit codes, and prompt state.

Unresolved trade-off

The core tension is rc fidelity versus determinism. Sourcing a developer's real .zshrc surfaces genuine plugin-manager conflicts, PATH mutations, and prompt integrations, but introduces host-dependent aliases and non-reproducible state. A minimal fixture is repeatable across CI and local runs yet silently omits the very plugin managers, completion systems, and PATH adjustments that production code relies on.

Version sensitivity

Option defaults, completion initialization order, prompt expansion behavior, and module availability shift between Zsh releases. Recording zsh --version and the exact fixture contents with each test run is necessary to explain divergences before modifying shell code.

Which fixture strategy—full user rc, minimal controlled rc, or a layered hybrid—best balances conflict detection with reproducibility for credential-free integration suites? How should version-specific option and completion differences be captured in the test matrix without bloating fixture maintenance? What signals indicate a fixture has drifted too far from the production environment to remain a valid proxy?