cowork e4ede1fd4f Bundle S CI follow-up #2: G-3 env-var collision + gopter discard-storm ...

Two CI failures from the previous Bundle S commits:

1. G-3 env-var docs drift guard caught three test-only env vars in
   cmd/agent/dispatch_test.go that started with CERTCTL_:
     CERTCTL_NONEXISTENT_TEST_VAR / CERTCTL_TEST_VAR / CERTCTL_BOOL_TEST
   Renamed to TESTONLY_AGENT_* — the getEnvDefault / getEnvBoolDefault
   tests don't depend on the CERTCTL_ namespace; they validate the
   helpers' fallback behavior with arbitrary keys.

2. TestProperty_WrongPassphraseRejected gave up under -race after
   '26 passed, 132 discarded'. Root cause: gen.AlphaString().SuchThat(
   len(s)>0 && len(s)<64) rejected too many cases; gopter's discard
   threshold tripped before MinSuccessfulTests (30) was reached.
   Same issue in the round-trip property.

   Fix: drop SuchThat on both crypto property tests; sanitize length
   INSIDE the predicate (substitute 'default-key' for empty; truncate
   strings >50 chars). Result: 0 discards. Both tests pass cleanly
   in 11.9s without -race.

Verification
  - go test -short -count=1 ./cmd/agent/... PASS (no test-name
    surprises)
  - go test -count=1 -timeout=120s -run='TestProperty_' ./internal/
    crypto/... PASS in 11.9s

Bundle: S-ci-fix-2

2026-04-27 19:24:27 +00:00

..

encryption_property_test.go

Bundle S CI follow-up #2: G-3 env-var collision + gopter discard-storm

2026-04-27 19:24:27 +00:00

encryption_test.go

Bundle B: Auth & transport surface tightening — 5 findings closed

2026-04-26 23:09:10 +00:00

encryption_v3_test.go

Bundle B: Auth & transport surface tightening — 5 findings closed

2026-04-26 23:09:10 +00:00

encryption.go

Bundle B: Auth & transport surface tightening — 5 findings closed

2026-04-26 23:09:10 +00:00