ci: run the test suite

CI ran fmt, clippy, build and audit but never `cargo test`, so none of the
310 tests had ever run on a pull request. That included the regression
tests written specifically to guard past incidents: the recording rotation
that deleted in-progress files, and the credential-variable folder scan
that hid subfolder-granted entries from operators. Both could have been
reintroduced without CI noticing.

Runs the debug profile rather than --release on purpose. debug_assertions
and integer overflow checks are compiled in there and switched off in a
release build, and the wire-protocol parser is where an overflow would
otherwise pass silently.

Noted by @joshsol1 on #230.

.github/workflows/ci.yml

@@ -49,6 +49,16 @@ jobs:
       - name: Build
         run: $HOME/.cargo/bin/cargo build --release
 
+      - name: Test
+        # Debug profile deliberately, not --release: debug_assertions and
+        # integer overflow checks are compiled in, and both are switched off
+        # in a release build. The wire-protocol parser and the session
+        # bookkeeping are exactly where an overflow would otherwise pass
+        # silently. Until now nothing here ran the suite at all, so the
+        # regression tests guarding past data-loss and access-control bugs
+        # were never exercised on a PR.
+        run: $HOME/.cargo/bin/cargo test
+
       - name: Security audit
         # Ignored advisories + rationale live in .cargo/audit.toml so new
         # advisories on the same crates still surface.