Bundle Q (Coverage Audit Closure): property-based pilot + hygiene — L-001/L-002/L-003/L-004/I-001 closed

Five small closures wrapping the Low-tier and Info-tier audit findings.

Q.1 — cmd/cli round-out (L-001 closed)
======================================
cmd/cli/dispatch_test.go: ~30 dispatch tests across handleCerts /
handleAgents / handleJobs / handleImport / handleStatus. httptest.NewTLSServer
mocks the API; cli.NewClient(_, _, _, _, true) constructs an
insecure-skip-verify client. Each test pins the missing-args usage-print
path AND the happy-path delegation. Result: 7.1% -> 63.5% coverage
(gate: >=30%).

Q.2 — awssm round-out (L-002 closed)
======================================
internal/connector/discovery/awssm/awssm_edge_test.go: New() default
constructor, extractKeyInfo (ECDSA/Ed25519/unknown — was RSA-only),
processSecret filter arms (NamePrefix mismatch / TagFilter mismatch /
empty-value / GetSecretValue error), realSMClient stub-contract pin
(ListSecrets / GetSecretValue / NewRealSMClient), and EmailAddresses
SAN extraction. Result: 78.2% -> 96.0% coverage (gate: >=85%).

Q.3 — Property-based testing pilot (L-003 closed)
======================================
gopter@v0.2.11 added to go.mod (test-only).

internal/crypto/encryption_property_test.go:
- TestProperty_EncryptDecryptRoundTrip — 50 successful tests,
  DecryptIfKeySet(EncryptIfKeySet(x, k), k) == x
- TestProperty_WrongPassphraseRejected — 30 successful tests,
  AEAD never returns nil-error AND bytes-equal plaintext under
  wrong passphrase
Both skipped under -short to keep developer loop fast (PBKDF2 600k
rounds × 50 iters ≈ 15s on -race CI).

internal/pkcs7/length_property_test.go:
- TestProperty_ASN1LengthRoundTrip — three sub-properties:
  decodeLength(encode(x)) == x for x ∈ [0, 2³¹−1]; short-form
  invariant (length<128 → 1 byte == length); long-form invariant
  (length>=128 → high bit set + N bytes follow). 500 successful
  tests in <10ms.

Q.4 — Architecture diagram multi-agent update (L-004 closed)
======================================
docs/qa-test-guide.md::Architecture: ASCII diagram updated to show
'certctl-agent (×N)' + callout explaining seed_demo.sql provisions
12 agent rows (1 active, 2 retired, 9 reserved/sentinel) for Parts
04, 05, 55 + FSM coverage. Operators running parallel-agent topologies
guided to AGENT_COUNT=N + 'make qa-stats'.

Q.5 — Test-naming CI guard (I-001 closed)
======================================
.github/workflows/ci.yml: Test-naming convention guard added after
the QA-doc seed-count drift guard. Greps for func Test<X>( missing
the <X>_<Scenario> suffix. Prints first 20 non-conformant as
::warning:: annotations. continue-on-error: true (informational).
Excludes TestMain + TestProperty_*. Promotion to hard-fail tracked
as I-001-extended.

Verification
======================================
- python3 yaml.safe_load on ci.yml: OK
- go vet ./cmd/cli/... ./internal/connector/discovery/awssm/...
  ./internal/crypto/... ./internal/pkcs7/...: clean
- go test -short -count=1 across all four packages: PASS
- go test -count=1 (full property tests): PASS
  - crypto 15.4s (50 + 30 × 600k PBKDF2)
  - pkcs7 5ms

Audit deliverables
======================================
- gap-backlog.md: strikethroughs on L-001/L-002/L-003/L-004/I-001
  with per-finding closure note
- closure-plan.md: ticks Bundle Q [x] with per-item breakdown

Closes: L-001, L-002, L-003, L-004, I-001
Bundle: Q (Property-Based + Hygiene)

.github/workflows/ci.yml

@@ -896,6 +896,34 @@ jobs:
           fi
           echo "QA-doc seed-count drift guard: clean."
 
+      # Bundle Q / I-001 closure — test-naming convention guard (informational).
+      # The convention is `Test<Func>_<Scenario>_<ExpectedResult>`. This step
+      # prints any non-conformant tests but does NOT fail the build until the
+      # team adopts the convention repo-wide. Set `continue-on-error: true`
+      # so a regression here doesn't block PRs; remove the flag to promote
+      # to hard-fail in a future commit.
+      - name: Test-naming convention guard (informational)
+        continue-on-error: true
+        run: |
+          # Non-conformant: function names of the shape `func Test<X>(` where
+          # the first underscore-separated token after `Test` is missing —
+          # i.e. tests not adopting the Test<Func>_<Scenario>_<ExpectedResult>
+          # convention. We intentionally exclude TestMain (Go's special
+          # test-init hook) and the legacy property-test naming TestProperty_*.
+          NON_CONFORMANT=$(grep -rnE '^func Test[A-Z][A-Za-z0-9]+\(' --include='*_test.go' . \
+            | grep -vE 'func Test[A-Z][A-Za-z0-9]+_[A-Z]' \
+            | grep -vE 'func TestMain\(|func TestProperty_' \
+            || true)
+          if [ -n "$NON_CONFORMANT" ]; then
+            COUNT=$(echo "$NON_CONFORMANT" | wc -l)
+            echo "::warning::Test naming convention drift (informational, $COUNT sites):"
+            echo "$NON_CONFORMANT" | head -20
+            echo "..."
+            echo "Tests should follow Test<Func>_<Scenario>_<ExpectedResult> per docs/qa-test-guide.md."
+          else
+            echo "Test-naming convention guard: clean."
+          fi
+
   frontend-build:
     name: Frontend Build
     runs-on: ubuntu-latest