perf(test-infra): faster local test/lint loops for agents and devs

[matdev83]

Summary

Cuts the dominant local iteration costs measured on a 16-core Windows dev box (where coding agents run these targets hundreds of times per day):

• Full test suite: 4.22 min → 1.84 min — \GO_TEST_FLAGS\ (and every script route) now defaults -parallel\ to the machine's logical core count instead of a fixed 8; override with \LIP_TEST_PARALLEL=.
• Fuzz smoke: ~130 s → ~45 s — the 65 Tier-1 fuzz targets move to one canonical list (\scripts/fuzz-targets.tsv) consumed by both platforms; POSIX runs pooled \scripts/fuzz-smoke.sh, Windows pools through \Invoke-PooledTaskRunner\ (8 concurrent × 2 workers), still routing through the testing: Fuzz testing with fuzztime flag sometimes fails incorrectly with "context deadline exceeded" golang/go#75804-tolerant wrapper.
• parity-checks merges the three identically-flagged root contract batches into one invocation and runs independent nested connector modules in a bounded pool.
• Pre-commit hook: ~50 s lighter per commit — lint + govulncheck become opt-in via \LIP_PRECOMMIT_FULL=1\ / \make precommit-full, matching the fast-by-default contract already documented; PR CI retains full coverage.

Also includes

• Fix pre-existing \check-staged-secrets.sh\ bug: it grepped the entire staged index, so any commit failed when gitleaks was absent (committed redaction-test fixtures match credential patterns). Now scans staged added lines with file attribution; deletions deliberately ignored.
• Reconcile/complete a half-applied parallelization of \windows-task.ps1\ (file did not parse before this branch's fixes).
• \internal/qa\ infrastructure contracts re-pointed at the new structure without weakening intent: TSV structural validation (exact Fuzz selectors, rooted packages, real module dirs, no duplicate rows), wrapper enforcement in the smoke script, parallelism asserted as present rather than pinned to 8.

Constraints honored

• No test/assertion weakening (verified: zero removed Test/Benchmark/Fuzz funcs, zero added skips across the branch).
• CI ownership unchanged: race stays Linux-authoritative (nightly/release), cross-platform matrices untouched.
• Nightly \make test-fuzz FUZZTIME=2s\ path inherits the pooled runners unchanged.
• Change size: 12 Go/script paths in this commit, well under the 100-file gate.

Verification evidence

• Fuzz smoke E2E: Windows pool path 65/65 pass (44.5 s); Git-bash native POSIX runner 65/65 pass
• Pre-commit hook both modes: default skips lint/vuln (exit 0); \LIP_PRECOMMIT_FULL=1\ executes them (shim-proved)
• Secrets scanner: clean staged commit now passes; fake AWS key flagged with file attribution
• \make parity-checks: exit 0 (~23 s warm); \make quality-checks: exit 0; \make test-unit: exit 0; full \internal/qa, gofmt, \go vet: clean; \go mod verify: all modules verified

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e3f0092d-90ec-4cd8-874a-e0cde877e6d6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}