test(p2): pin loose error/output assertions to exact strings (#62 P2)

[bashandbone]

Closes the last open item from the #62 audit, plus two follow-ups found while auditing it.

P2 — the loose assertions

integration_tests.rs and command_contract_tests.rs were the two files the earlier P2 batch never reached. Between them they had 11 wide || disjunctions and zero exit-code assertions.

Several couldn't fail in a useful way:

Assertion	Why it was weak
contains("already exists") || contains("Use --force")	both halves come from the same format string
contains("Nuking") || contains("💥")	likewise one println!
contains("Added submodule") || contains("movable-lib")	second half implied by the first, which embeds the name
contains("complete") || contains("_submod") || contains("submod")	the last alternate matches any output mentioning the binary — the bash completion test passed on anything
contains("Nuking") || contains("Reinitializing")	a nuke-without---kill that skipped the reinit half would still pass
contains("Initializing") || contains("initialized")	could not distinguish the two states it was meant to check
contains("Updated") || contains("Already up to date")	"Already up to date" appears nowhere in the source — only one half was ever reachable

Each is now pinned to the exact string the binary emits, and the two-part cases (nuke + reinit, --all across both submodules) assert each part separately so half-completion fails.

Added assert_eq!(output.status.code(), Some(1)) to the four failing-command tests in integration_tests.rs. The invalid-repo test now requires that the underlying Repository not found cause survives the Failed to create manager wrapping, instead of accepting either one.

Found while writing the update assertion: submod update never names the submodules it touched — it forwards raw fetch refspec output to stdout and then prints a summary count:

+refs/heads/*:refs/remotes/origin/*
	78a3d071… refs/heads/main -> refs/remotes/origin/main [up-to-date]
Updated 1 submodule(s)

The test now pins the count, which is the real contract. The plumbing passthrough is cosmetic and left as a separate concern — flagging it because it's the kind of thing an untightened assertion hides.

Follow-ups

• #![forbid(unsafe_code)] in lib.rs and main.rs. Cargo.toml was relaxed from forbid to deny so the test crate could #![allow(unsafe_code)] for its tracking allocator — which left every src/ file able to opt out silently. The library and binary now can't.
• CLAUDE.md claimed performance_tests.rs — benchmarks (uses criterion), which is exactly the doc drift P3 called out; criterion lives in benches/benchmark.rs. Corrected, and the file list now covers fallback_tests.rs, git_ops_tests.rs, and security_tests.rs, with a pointer to the harness's git-state helpers so future tests reach for those over printed output.

Verification

Full suite 569 pass, 0 failed; cargo fmt --check and cargo clippy --all-features --all-targets clean.

Closes #62.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Files with missing lines	Coverage Δ
src/main.rs	97.46% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.