Implement milestone 14 P4 lifecycle and test hygiene

[bjcorder]

Summary

Implements GitHub milestone 14 / v0.2 P4 lifecycle and test-hygiene issues #87-#95.

• Adds lifecycle review findings for JWT logout denylist gaps, refresh-family logout revocation gaps, sliding expiry without rotation, and password-change without global revocation.
• Adds clean-baseline false-positive fixtures across framework families for the P1-P4 check inventory.
• Adds hand-rolled JSON report snapshot tests and Rust integration coverage for the CLI exit-code matrix.
• Documents the consolidated category-audit decision: no new finding category, schema bump, or SARIF rule change required.
• Completes final v0.2 docs updates across CHANGELOG, README, roadmap, and coverage matrix.
• Addresses final review findings by tightening P4.4 global-revocation suppression and adding explain redaction regression coverage.

Issues / commits

• Fixes P4.1: Classifier — JWT denylist absent on logout #87 — a6a77a2 JWT denylist absent on logout
• Fixes P4.2: Classifier — refresh-family revocation absent on logout #88 — 618c798 refresh-family revocation absent on logout
• Fixes P4.3: Classifier — sliding/idle expiry without rotation #89 — ff6d451 sliding/idle expiry without rotation
• Fixes P4.4: Classifier — password-change without global revocation #90 — 4ecbc68, follow-up 9a2fabd password-change without global revocation
• Fixes P4.5: Fixtures — false-positive coverage for every new P1-P4 check ID #91 — 40618f1 clean false-positive fixtures
• Fixes P4.6: JSON snapshot tests — per framework family #92 — 406c2dd JSON snapshot tests
• Fixes P4.7: CLI exit-code matrix tests #93 — 2d2196c CLI exit-code matrix tests
• Fixes P4.8: Consolidated category-audit decision #94 — c498fef consolidated category audit
• Fixes P4.9: Final docs pass — CHANGELOG, README sample, ROADMAP, matrix completion #95 — 59cbe54 final docs pass

Tracker: #62

Validation

• cargo fmt --check
• cargo check --workspace
• cargo test -q
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --all-targets

Review results

Fresh-context completion, correctness, security, and /sec-review passes were run.

• Completion review: no confirmed milestone blockers.
• Correctness review: no blockers; optional OAuth/provider/fixture enforcement improvements deferred.
• Security review: one P4.4 blocker fixed in 9a2fabd.
• /sec-review: explain redaction path already sanitized reports before rendering; regression coverage added in 9a2fabd.

Deferred follow-ups

• Broaden OAuth CommonJS/import-only suppression.
• Reconcile/document NextAuth/Auth.js provider coverage limits.
• Consider enforcing every fixture expected.json finding generically.
• Consider P3-specific JSON snapshots.
• Consider bounded file-size reads for sessionscope explain.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[bjcorder]

Review/remediation update:

Summary:

• Resolved PR Implement milestone 14 P4 lifecycle and test hygiene #99 merge conflicts with latest origin/main while preserving P3 base changes and P4 lifecycle/test-hygiene changes.
• Fixed review blockers for JWT logout denylist suppression, OAuth state/nonce issuance-vs-validation detection, wildcard loopback redirect URIs, and OAuth/client secret redaction.
• Added focused regression coverage for the remediated cases, plus a small client-storage template-literal cookie key coverage improvement flagged by review.

Security/regression review:

• Fresh-context follow-up reviewers found no remaining blockers after the second follow-up pass.
• Central redaction now covers quoted camelCase clientSecret values, and OAuth detector-local redaction covers short quoted clientSecret values.

Merge conflicts:

• Resolved in 50631e6.

Validation:

• cargo fmt --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed
• cargo test --workspace --all-targets — passed

Commits pushed:

• 50631e6 — Address PR Implement milestone 14 P4 lifecycle and test hygiene #99 review findings

Remaining notes:

• None

[bjcorder]

CI follow-up update:

Summary:

• Fixed the failing Windows cargo test --workspace --all-targets check.
• Root cause was JSON snapshot comparison normalizing Windows path separators but not CRLF line endings from checkout, causing snapshot text mismatch on Windows only.
• Updated snapshot normalization to normalize CRLF to LF and added regression coverage.

Validation:

• cargo test -q -p sessionscope-testing snapshots — passed
• cargo test -q -p sessionscope-testing --test json_snapshots — passed
• cargo fmt --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed
• cargo test --workspace --all-targets — passed

Commits pushed:

• d240ade — Address PR Implement milestone 14 P4 lifecycle and test hygiene #99 Windows snapshot check

Remaining notes:

• Waiting for GitHub CI to rerun on the pushed commit.

[bjcorder]

CI follow-up update 2:

The Windows snapshot failure persisted because the previous fix only normalized snapshot text. The actual scan output also needed deterministic source text before detector offsets/excerpts are produced.

Summary:

• Normalized source file line endings to LF during source loading in sessionscope-core.
• Kept snapshot normalization tolerant of actual and escaped CRLF sequences.
• Added regression coverage for CRLF source reads and snapshot normalization.
• Reproduced the Windows-only condition locally by converting the failing Express fixture to CRLF; json_snapshots now passes under that simulation.

Validation:

• cargo test -q -p sessionscope-core source::tests::normalizes_windows_line_endings_for_deterministic_scans — passed
• cargo test -q -p sessionscope-testing snapshots — passed
• CRLF fixture simulation + cargo test -q -p sessionscope-testing --test json_snapshots — passed
• cargo fmt --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed
• cargo test --workspace --all-targets — passed

Commit pushed:

• 39680e2 — Fix Windows snapshot CI line endings

Waiting for GitHub CI to rerun on the new commit.