test(harness): L2 marker + skip-when-no-.env guard (D3, Testing Strategy)

conftest loads harness/.env once (session, autouse) via python-dotenv, and exposes
an l2_env fixture that SKIPS (not fails) when any L2 prerequisite var is missing/
empty: THOTH_DWH_API_KEY, THOTH_VEC_API_KEY, THOTH_VEC_WRITE_API_KEY, THOTH_SSL_CA.
So the default run (pytest = L0+L1, addopts '-m not l2') stays green without .env;
only pytest -m l2 (pre-release, with .env + VPN) exercises them. l0/l2 markers were
registered in A9. tests/l2/ package created for the L2 tests (D4, D5).

harness/tests/conftest.py

@@ -3,6 +3,7 @@ import sys
 from pathlib import Path
 
 import pytest
+from dotenv import load_dotenv
 from sqlalchemy import create_engine
 from testcontainers.postgres import PostgresContainer
 
@@ -15,6 +16,28 @@ if str(_ROOT) not in sys.path:
 # Directory sessions/ risolta relativamente alla root harness (per i test che creano sessioni)
 os.environ.setdefault("NSP_HARNESS_ROOT", str(_ROOT))
 
+# L2 tests need the remote credentials from harness/.env (gitignored). Loaded once,
+# autouse, before any test. L0/L1 tests don't read these vars; missing .env only
+# affects the L2 skip guard below, so L0/L1 never break for missing credentials.
+load_dotenv(_ROOT / ".env")
+
+# L2 connection prerequisites (spec Testing Strategy). If any is missing/empty, L2
+# tests are SKIPPED (not failed) so the default run (pytest = L0+L1) stays green.
+REQUIRED_L2 = ["THOTH_DWH_API_KEY", "THOTH_VEC_API_KEY", "THOTH_VEC_WRITE_API_KEY", "THOTH_SSL_CA"]
+
+
+@pytest.fixture(scope="session")
+def l2_env():
+    """Skip the test (not fail) when L2 credentials are absent. Use in every L2 test:
+    `def test_x(l2_env): ...`. Returns True so the test body runs once env is confirmed."""
+    missing = [v for v in REQUIRED_L2 if not os.environ.get(v, "").strip()]
+    if missing:
+        pytest.skip(
+            f"L2 skipped -- missing env vars: {', '.join(missing)} "
+            f"(populate harness/.env and connect via VPN)"
+        )
+    return True
+
 
 # --- L0 fixtures (testcontainers, real Postgres) --------------------------------
 # Session-scoped: un solo container per tutta la run L0. Schema fixture caricato una