Consolidate shared test helpers and stabilize timeout hook integration test

internal/testsupport/files.go

@@ -0,0 +1,57 @@
+package testsupport
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func ReadFile(t *testing.T, path string) []byte {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read file %q: %v", path, err)
+	}
+	return data
+}
+
+func OnlyRunDir(t *testing.T, workDir string) string {
+	t.Helper()
+	entries, err := os.ReadDir(workDir)
+	if err != nil {
+		t.Fatalf("failed to read work dir %q: %v", workDir, err)
+	}
+	dirs := make([]string, 0, len(entries))
+	for _, e := range entries {
+		if e.IsDir() {
+			dirs = append(dirs, filepath.Join(workDir, e.Name()))
+		}
+	}
+	if len(dirs) != 1 {
+		t.Fatalf("expected exactly one run dir in %q, found %d", workDir, len(dirs))
+	}
+	return dirs[0]
+}
+
+func AssertNoSecretInFile(t *testing.T, path, secret string) {
+	t.Helper()
+	raw := string(ReadFile(t, path))
+	if strings.Contains(raw, secret) {
+		t.Fatalf("secret leaked in %s", path)
+	}
+}
+
+func AssertNoSecretInTree(t *testing.T, root, secret string) {
+	t.Helper()
+	_ = filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
+		if err != nil || d == nil || d.IsDir() {
+			return nil
+		}
+		raw, readErr := os.ReadFile(path)
+		if readErr == nil && strings.Contains(string(raw), secret) {
+			t.Fatalf("secret leaked in %s", path)
+		}
+		return nil
+	})
+}