Fix tests for tag removal and version behavior

- Fix upload response to return actual version (not requested version)
  when artifact already has a version in the package
- Update ref_count tests to use multiple packages (one version per
  artifact per package design constraint)
- Remove allow_public_internet references from upstream caching tests
- Update consistency check test to not assert global system health
- Add versions field to artifact schemas
- Fix dependencies resolution to handle removed tag constraint

backend/tests/integration/test_concurrent_operations.py

@@ -195,19 +195,38 @@ class TestConcurrentUploads:
 
     @pytest.mark.integration
     @pytest.mark.concurrent
-    def test_concurrent_uploads_same_file_deduplication(self, integration_client, test_package):
-        """Test concurrent uploads of same file handle deduplication correctly."""
-        project, package = test_package
+    def test_concurrent_uploads_same_file_deduplication(
+        self, integration_client, test_project, unique_test_id
+    ):
+        """Test concurrent uploads of same file handle deduplication correctly.
+
+        Same content uploaded to different packages should result in:
+        - Same artifact_id (content-addressable)
+        - ref_count = number of packages (one version per package)
+        """
+        project = test_project
         api_key = get_api_key(integration_client)
         assert api_key, "Failed to create API key"
 
-        content, expected_hash = generate_content_with_hash(4096, seed=999)
         num_concurrent = 5
+        package_names = []
+
+        # Create multiple packages for concurrent uploads
+        for i in range(num_concurrent):
+            pkg_name = f"dedup-pkg-{unique_test_id}-{i}"
+            response = integration_client.post(
+                f"/api/v1/project/{project}/packages",
+                json={"name": pkg_name, "description": f"Dedup test package {i}"},
+            )
+            assert response.status_code == 200
+            package_names.append(pkg_name)
+
+        content, expected_hash = generate_content_with_hash(4096, seed=999)
 
         results = []
         errors = []
 
-        def upload_worker(idx):
+        def upload_worker(idx, package):
             try:
                 from httpx import Client
                 base_url = os.environ.get("ORCHARD_TEST_URL", "http://localhost:8080")
@@ -219,7 +238,7 @@ class TestConcurrentUploads:
                     response = client.post(
                         f"/api/v1/project/{project}/{package}/upload",
                         files=files,
-                        data={"version": f"dedup-{idx}"},
+                        data={"version": "1.0.0"},
                         headers={"Authorization": f"Bearer {api_key}"},
                     )
                     if response.status_code == 200:
@@ -230,7 +249,10 @@ class TestConcurrentUploads:
                 errors.append(f"Worker {idx}: {str(e)}")
 
         with ThreadPoolExecutor(max_workers=num_concurrent) as executor:
-            futures = [executor.submit(upload_worker, i) for i in range(num_concurrent)]
+            futures = [
+                executor.submit(upload_worker, i, package_names[i])
+                for i in range(num_concurrent)
+            ]
             for future in as_completed(futures):
                 pass
 
@@ -242,7 +264,7 @@ class TestConcurrentUploads:
         assert len(artifact_ids) == 1
         assert expected_hash in artifact_ids
 
-        # Verify final ref_count equals number of uploads
+        # Verify final ref_count equals number of packages
         response = integration_client.get(f"/api/v1/artifact/{expected_hash}")
         assert response.status_code == 200
         assert response.json()["ref_count"] == num_concurrent