quality(coverage): remove broad V8 ignore from credential-exchange security core

[seonghobae]

Completed protected-main coverage contract

The credential-exchange coverage defect and its stale documentation are now repaired on protected main without lowering thresholds or restoring broad V8 exclusions.

Protected source truth

The source repair arrived in bounded test-first slices:

• quality(coverage): measure OIDC verification core #404 — OIDC discovery/JWKS/JWT verification and malformed upstream/key-material classification;
• test(coverage): measure exchange success path #405 — public /exchange success path;
• test(coverage): measure replay request core #406 — replay/request core;
• test(coverage): measure GitHub App runtime core #408 — GitHub App installation lookup/cache/token runtime core and the final remaining broad-ignore removal.

Final #408 exact head cb349a7c900cf49e854bf26775992c683e4afee6 passed application CI 32034519303, reviewer-ci 32034519390, and eligible central Security Scan 32034519380 before merging as protected commit 15ccf1226fe92468dc0a0e3761f3fe8bb328f2a9.

Current protected descendants still contain no v8 ignore directive in src/index.ts; a fresh repository search on the current protected lineage returns no such marker there.

Canonical documentation convergence

Canonical documentation PR #71 subsequently integrated. Protected docs/TEST_STRATEGY.md now states that owned production statements/branches/functions/lines remain at 100% where exposed and that coverage exclusions do not replace executable behavior tests. The canonical documentation fitness/traceability graph records issue #84's source repair as protected truth rather than an active source gap.

PR #417 then repaired the remaining contributor-facing contradiction in CLAUDE.md and added an executable documentation regression. It merged as current protected commit 38d2b2d1c063611c87d9a610e91f88ed89ba9fa3:

• CLAUDE.md now states that broad credential/security V8 exclusions are regressions and points to docs/TEST_STRATEGY.md;
• test/documentation-active-work-contract.test.ts rejects the old claim that /* v8 ignore */ markers in src/index.ts are deliberate and requires the current test-strategy guidance;
• CHANGELOG.md was inspected on the surviving protected lineage and did not contain a stale protected-truth claim requiring a competing changelog-only mutation.

Protected-main proof

After #417 merged, protected-main application CI 32063372997 executed against exact protected commit 38d2b2d1c063611c87d9a610e91f88ed89ba9fa3 and completed success. This runs the repository documentation/coverage contracts from protected source, including the regression that fails if the broad credential/security exclusion guidance is reintroduced.

The reviewer-ci push run is a separate evidence channel and is not promoted into application-test authority; queued/pending evidence is not treated as success.

Completion criteria

• Historical broad V8 exclusions removed from credential/security production code.
• Realistic runtime/public paths measure the restored production branches.
• Exact configured owned-production statement/branch/function/line thresholds remain at 100% without threshold reduction.
• Protected src/index.ts has no broad/residual V8-ignore directive.
• Canonical docs/TEST_STRATEGY.md, documentation fitness, and traceability reflect protected truth.
• Contributor guidance no longer teaches broad credential/security V8 exclusions as deliberate.
• Executable documentation regression fails closed on reintroduction of that stale guidance.
• Protected-main application CI passes with the documentation/coverage contract enabled.
• No release, deployment, KPI, revenue, legal-rights, or acquisition-ready claim is inferred from coverage success.

Related: #71, #82, #404, #405, #406, #408, #417.