chore(lint): enable testifylint and thelper, and fix what they found

[otavio]

What

Enables testifylint and thelper, and fixes the 216 findings they report across 63 files. All of it is test code.

Why

Fourth step of the lint expansion, after #6980, #6981 and #6982. These two are what make a failing test say the right thing: the assertion that failed, at the caller's line, instead of a nil panic three lines later.

Changes

One real bug. Two httptest handlers called require.NoError — in pkg/wsconnadapter and server/ssh/pkg/dialer. require reaches t.FailNow, which is only defined on the test's own goroutine. A failed WebSocket upgrade in those handlers would not have stopped the test the way the code reads. They now assert and return.

125 require-error. The recurring shape is an error asserted with assert, then the value it produced dereferenced on the next line. When the assertion fails the test keeps running and panics on nil, so the report is a crash rather than the assertion that actually failed. require stops there instead.

tests/environment had this hand-rolled seven times as if !assert.NoError(t, err) { assert.FailNow(t, err.Error()) }, which is require.NoError written out longhand. Those collapse to the real thing.

91 thelper. Helpers that take a *testing.T now declare it, so a failure points at the caller rather than at a line inside the helper. The storetest sub-suite closures took *testing.T second, which thelper reads as a helper with its parameters the wrong way round — they take it first now and runSubSuite's signature follows.

How

The rewrites were driven from the linter's own file:line output rather than typed, then the full suite was run to confirm no assertion changed a result. Two mechanical slips the process caught and I fixed: a t.Helper() insertion that landed in a composite literal because the target was a single-line empty closure, and 58 duplicated testify imports from the import pass.

Testing

Under golang:1.26.7-alpine3.24:

• golangci-lint run ./... reports 0 issues for all six modules, and for agent under no tags, -tags docker and -tags native
• go build ./... clean everywhere
• go test ./... passes for root, server, and agent under both docker and native
• go vet ./... clean; go mod tidy a no-op

https://claude.ai/code/session_01D4BSojj4fmh3ZQSZWkGbD8

[github-actions]

Claude finished @otavio's task in 4m 59s —— View job

---

Code Review Complete

Reviewed 63 files across code quality, security, testing, language patterns, and architecture — no new issues found. The code looks good as-is.

The change is mechanical and test-only. I verified the parts that carry actual semantic weight:

• The two goroutine-safety fixes (pkg/wsconnadapter/wsconnadapter_test.go, server/ssh/pkg/dialer/manager_test.go) — converting the in-handler require.NoError to if !assert.NoError(t, err) { return } is the correct direction, and the early return safely skips the nil-conn wrap and channel send. No reachable deadlock, since the client-side dial guards with require.NoError on the test goroutine first.
• runSubSuite signature swap (server/api/store/pg/store_test.go) — definition, function type, invocation (testFunc(t, suite)), and all call-site closures updated consistently to (t *testing.T, suite *storetest.Suite); nothing left with the old order.
• testifylint rewrites — argument reorders (Equal(t, 4, read)), substitutions (Len, Positive, ErrorIs/NotErrorAs, JSONEq, Equal for same-typed State) are all semantically equivalent; no operands swapped incorrectly.
• thelper insertions — every t.Helper() lands as the first statement of a real function body receiving *testing.T; the composite-literal slip noted in the PR description does not recur.
• Imports & config — no missing, duplicate, or now-unused imports in the changed files; the .golangci.yaml additions are correctly indented, unique, and spelled.

---

To request another review round, comment /review.
· chore/lint-testify