[EE-Smoke] Spec: opt out of let_it_be freeze in ee/spec (3 files) (#600267)

Description

Part of #600267 (closed).

Adds freeze: false to 3 let_it_be declaration(s) across 3 spec file(s) under ee/spec/ that mutate their subjects in examples or hooks.

This is a no-op against current master — let_it_be does not freeze by default today. The change is preparation for an eventual flip of the default (see !71373 (closed) and !234596 (closed)). With this patch in place, every file in this MR will continue to pass once the default is flipped.

Why per-call freeze: false and not the global config inverse?

You may wonder why this MR adds freeze: false to specific declarations rather than setting the inverse globally:

TestProf::LetItBe.configure do |config|
  config.default_modifiers[:freeze] = false
end

The end-state goal is 100 % frozen let_it_be subjects, not perpetual freeze: false. Inverting the global default would let new specs land without freeze: false and silently mutate shared state, undoing the progress made here. Patching per call:

• Identifies the exact set of subjects that need to remain mutable today (out of ~32 000 declarations in CE; only ~10 % need it).
• Lets us flip the global default to freeze: true once every shared subject that requires mutation is explicitly opted out.
• Surfaces every new mutation as a FrozenError at PR-time rather than as silent cross-test pollution.

See #600267 (closed) for the rollout plan and per-pass statistics.

Changes

• ee/spec/services/merge_trains/check_status_service_spec.rb — :project
• ee/spec/services/vulnerabilities/namespace_statistics/update_group_ancestors_statistics_service_spec.rb — :child_group

Verification

Each file was processed by the let-it-be-frozen-cleanup-harness (see #600267 (closed) for the methodology):

1. Append a working-tree-only patch to spec/support/let_it_be.rb that sets default_modifiers[:freeze] = true for let_it_be (and keeps freeze: false for let_it_be_with_reload / _with_refind).
2. Run bundle exec rspec <file> --format json. Collect every FrozenError failure.
3. Map each FrozenError backtrace frame back to the let_it_be(:NAME) declaration whose subject was mutated. Detect dependency chains: e.g. let_it_be(:award_emoji) { create(:award_emoji, awardable: note) } resolves to both :award_emoji and :note.
4. Rewrite each offending declaration with freeze: false via a Prism AST patcher (idempotent; preserves existing positional + keyword args).
5. Re-run the previously-failing examples; iterate up to 3 times if new FrozenErrors surface.
6. Discard the freeze fixture; keep only the spec edits in the commit.

In total this MR resolves 17 FrozenError(s) that would surface today if let_it_be defaulted to freeze: true.

Sample FrozenError traces from this rollup

ee/spec/services/merge_trains/check_status_service_spec.rb (sample of 1 failure(s)):

MergeTrains::CheckStatusService#execute when merge train is disabled on the project returns immediately without loading any Trains to check the history of
./ee/spec/services/merge_trains/check_status_service_spec.rb:102:in `block (4 levels) in <top (required)>'

ee/spec/services/vulnerabilities/namespace_statistics/update_group_ancestors_statistics_service_spec.rb (sample of 1 failure(s)):

Vulnerabilities::NamespaceStatistics::UpdateGroupAncestorsStatisticsService#execute when there is no group statistics record doesnt decrease statistics from original ancestors or increase for new ancestors
./ee/spec/services/vulnerabilities/namespace_statistics/update_group_ancestors_statistics_service_spec.rb:36:in `block (4 levels) in <top (required)>'

How a reviewer can spot-check

Every change in this MR is one of:

-    let_it_be(:foo) { ... }
+    let_it_be(:foo, freeze: false) { ... }

or

-    let_it_be(:foo, trait, attr: val) { ... }
+    let_it_be(:foo, trait, attr: val, freeze: false) { ... }

A git diff master..HEAD should show only freeze: false keyword arg insertions in let_it_be(...) calls.

References

• #600267 (closed) (tracking issue)
• !71373 (closed) (original freeze-default attempt)
• !234596 (closed) (RSpec/LetItBeImmutable cop, parent rollout)