test(forks): drop call-count assertions from the sync-default suite

CLAUDE.md forbids tests that assert a mock was called. Three assertions in
this suite were exactly that shape - `mock.calls).toHaveLength(0)` on the
audit and analytics mocks - and they proved only what the mock itself
decided, not anything about the use case.

The no-op case now asserts the result instead: `projectAudit` maps over
`changedWorkspaces` and `afterSuccess` returns early when it is empty, so an
empty result IS "no audit, no analytics", pinned to the value the fan-out
actually reads. The admission case keeps its rejection assertion, which is
the real guarantee: admission runs before the transaction opens.

What stays reads the CONTENT of the entries filed - each one carried by its
own workspace id and name - which is a fan-out invariant type-check cannot
see and the reason this suite exists. Confirmed it still goes red on the
pre-fix code: reverting the audit-name guard fails with
"expected 'root-ws' to be 'Name of root-ws'".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: mzxchandra

apps/sim/ee/workspace-forking/application/sync-default.test.ts

@@ -5,7 +5,7 @@ import { createSessionPrincipal } from '@sim/testing/factories/principal.factory
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import { dbChainMockFns, resetDbChainMock } from '@sim/testing/mocks/database.mock'
 import { permissionsMock, permissionsMockFns } from '@sim/testing/mocks/permissions.mock'
-import { posthogServerMock, posthogServerMockFns } from '@sim/testing/mocks/posthog-server.mock'
+import { posthogServerMock } from '@sim/testing/mocks/posthog-server.mock'
 import {
   workspaceAuthorizationMock,
   workspaceAuthorizationMockFns,
@@ -94,11 +94,14 @@ describe('setForkSyncDefault', () => {
     }
   })
 
-  it('writes no audit and no analytics when the value already matched everywhere', async () => {
+  /**
+   * `projectAudit` maps over `changedWorkspaces` and `afterSuccess` returns early when it
+   * is empty, so an empty result IS "no audit, no analytics". Asserting the result rather
+   * than the mocks' call counts keeps this pinned to the value the fan-out reads.
+   */
+  it('reports no changed members when the value already matched everywhere', async () => {
     dbChainMockFns.returning.mockResolvedValue([])
     await expect(run(true)).resolves.toMatchObject({ changedWorkspaces: [] })
-    expect(auditMockFns.mockRecordAudit.mock.calls).toHaveLength(0)
-    expect(posthogServerMockFns.mockCaptureServerEvent.mock.calls).toHaveLength(0)
   })
 
   /**
@@ -119,12 +122,11 @@ describe('setForkSyncDefault', () => {
    * is the only thing standing between a non-admin and a lineage-wide write. Assert it
    * rejects rather than trusting that the wrapper was wired up.
    */
-  it('rejects a caller who fails workspace admission, writing nothing', async () => {
+  it('rejects a caller who fails workspace admission', async () => {
     workspaceAuthorizationMockFns.mockAuthorizeWorkspaceOperation.mockRejectedValue(
       new Error('forbidden')
     )
     await expect(run(true)).rejects.toThrow('forbidden')
-    expect(auditMockFns.mockRecordAudit.mock.calls).toHaveLength(0)
   })
 
   it('carries the chosen value through, so turning the default back on is symmetric', async () => {