v0.3.2 P1 cleanup: split core modules and harden verification

[nmhuei]

Summary

This PR completes the v0.3.2 P1 cleanup pass after the v0.3.1 release.

It focuses on maintainability, CI hardening, and verification quality. No product features are added.

What changed

Module splits

• Split src/opencode/forward.rs into smaller modules:

  • forward.rs
  • retry.rs
  • sanitize.rs

• Split src/proxy_pool.rs into:

  • proxy_pool/mod.rs
  • proxy_pool/types.rs
  • proxy_pool/routing.rs
  • proxy_pool/maintenance.rs

CI and verification hardening

• Made ShellCheck blocking by removing continue-on-error: true.

• Expanded ShellCheck coverage for:

  • start.sh
  • stop.sh
  • install.sh
  • verification scripts

Docker hygiene

• Added .dockerignore.
• Added Dockerfile hygiene checks.
• Added apk --no-cache validation.

Test coverage

• Added fast integration test gate.

• Current status:

  • 87 unit tests passing
  • 5 fast integration tests passing
  • 18 heavy integration tests still ignored as intended

Dependency security

• Added blocking cargo audit.
• Added blocking cargo deny.
• Updated reqwest from 0.11 to 0.12, resolving 3 CVEs.
• Added deny.toml for license, advisory, and banned dependency checks.

Commits

• a8efd61 — refactor module split
• c62426e — strict ShellCheck blocking
• 998d731 — Docker hygiene gates + fast integration test gate
• d23132d — cargo audit / cargo deny + dependency security fixes

Verification

All checks pass:

cargo fmt --check
cargo clippy -- -D warnings
cargo check --locked --all-targets
cargo test --locked
cargo test --locked --test integration
./scripts/verify.sh all --profile ci

Result:

• 87 unit tests passing
• 5 fast integration tests passing
• Clippy clean
• Format clean
• Locked check clean
• Full verification clean

Risk

Low to medium.

The main code changes are module splits, so the primary risk is import/module wiring. Runtime behavior is intended to remain unchanged. CI, tests, and verification all pass after the split.