fix(dx): repair build, update CLAUDE.md, add tests for untested paths
- Fix cmd/forge build failure: remove extra locales.FS arg from
RegisterCommands (signature takes single CommandRegistration)
- Update CLAUDE.md error handling section to document coreerr.E()
pattern (was outdated log.E/fmt.Errorf reference)
- Add security_test.go for agentci: SanitizePath, EscapeShellArg,
SecureSSHCommand, MaskToken (coverage 56% → 68%)
- Add provider_handlers_test.go for pkg/api: category filter, nil
guards, manifest/verify/sign bad requests (coverage 31% → 52%)
- Audit confirms: no fmt.Errorf or os.ReadFile/WriteFile in production
code (only in test files)
Co-Authored-By: Virgil <virgil@lethean.io>
10c9e23e04