test(push): harden the ingestion engine — validators, security guards, helpers

[LukasWodka]

Summary

First PR from the CLI test-coverage audit — hardens internal/push (the correctness-critical ingestion/validation engine) with pure-additive tests: no production code changes, using harnesses that already exist. Closes two P0s and several P1/P2 gaps the audit surfaced.

All tests live in one new file, internal/push/coverage_hardening_test.go.

What's covered

Test	Target	Gap it closes
TestLabelSchemaType	labelSchemaType (preflight.go:702)	P0. The case/whitespace-insensitive fallback (was 28.6%) — mirrors the ingestor's LabelDiversityValidator._schema_type_for. A regression here silently mis-resolves a case-mismatched label column's SQL type → mis-collapses a VARCHAR label → false-rejects a diverse dataset the cluster accepts.
TestDiscoverSidecarFiles_SecurityGuards	discoverSidecarFiles (text.go:256)	P0 / security. The symlink-dir, symlink-entry, and not-a-dir rejects were 0% at the guard level. This walker backs annotations/ today and masks/ (semantic_segmentation) next, so a regression is an arbitrary-local-file-disclosure hole. Mirrors the images/ symlink pins in walk_test.go.
TestCheckSchemaColumns	CheckSchemaColumns (preflight.go:735)	P1. The missing-schema-column rejection never fired (every case had all columns present); case-sensitivity pinned too.
TestTruncateList	TruncateList (preflight.go:440)	P1. The "… and N more" truncation arithmetic — backs every offender list — was unexercised past the cap.
TestParseMinSize	ParseMinSize (detect.go:54)	The --min-size entry point (0%): grammar + that errors name the min size flag, not target size.
TestStderrSuffix	stderrSuffix (teardown.go:204)	0% — every existing Teardown/CleanStaging test had exec succeed, so the remote-stderr parenthetical was never rendered.
TestFinalDestPrefix	FinalDestPrefix (spec.go:449)	Security. The path-traversal panic guard — an unsafe table name must panic rather than construct a PVC path.

Not in this PR

ListDatasets (the 0% data list query path) needs a small production seam first — it constructs SPDYExecutor internally rather than accepting an Executor param like Teardown does. That lands in the follow-up seam-refactor PR (which also fixes data_list.go:118 routing through listDatasetsFn).

Test plan

• make ci green (build, -race tests, gofmt, lint, schema).
• Security-guard tests skip on Windows (symlinks need admin), matching walk_test.go.

Part of the coverage-audit backlog — first of a short series (seam refactors + the no-infra batch next).

🤖 Generated with Claude Code

---

Note

Low Risk
Test-only additions; no runtime behavior changes.

Overview
Adds internal/push/coverage_hardening_test.go with pure test coverage for internal/push—no production changes.

The new tests pin ParseMinSize (valid WxH grammar and errors that say min size, not target size), labelSchemaType (case/whitespace fallback for label SQL types), CheckSchemaColumns (missing columns, sorted names, case-sensitive headers), and TruncateList (offender-list truncation).

They also lock in security and error UX: discoverSidecarFiles rejects missing dirs, a file posing as a subdir, and symlinks (skipped on Windows); stderrSuffix formatting for remote stderr; and FinalDestPrefix panicking on unsafe table names.

^{Reviewed by Cursor Bugbot for commit 6ace36f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6ace36f. Configure here.}

[saadqbal]

Nice, careful PR 👍 Verified each test against the real functions — the symlink and label-schema-type pins especially are worth having. LGTM.