test: cover API clients, zip and seal pipeline

[dobby-coder]

What

Adds xUnit coverage for the critical paths that previously had no tests, per #10. All run on both net8.0 and net10.0.

New tests

• CryptifyClientTests — full chunked-upload flow driven by a recording HttpMessageHandler (no live Cryptify): init → chunk → finalize wiring, per-chunk Content-Range formatting, cryptifytoken rotation across chunks and into finalize, recipient-email joining, Notify option mapping (silent-by-default + propagation), and the missing-uuid / missing-token / non-2xx error paths.
• PkgClientTests — MPK and signing-key JSON parsing: string vs object publicKey, present / absent / null privSignKey, Bearer auth header + request body, and NetworkException on non-2xx.
• ZipHelperTests — archive round-trips for single, multiple, binary and empty inputs.
• SealPipelineTests — the non-ApiKey signing guard and parallel key-fetch failure propagation (asserts both PKG endpoints are hit). BuildPolicyJson was already covered by the existing BuildPolicyJsonTests.
• TestHelpers/RecordingHttpMessageHandler — reusable, thread-safe (the seal pipeline fires its two PKG calls concurrently) mock that records requests and replays queued responses.

Local run: 54 tests pass on net10.0 (dotnet test --framework net10.0 --configuration Release). Per repo notes, the workspace has no net8.0 runtime, so the net8.0 leg runs in CI; both frameworks compile locally.

CI change for a maintainer to apply

The bot cannot push workflow changes (no workflows permission), so the test project is in the solution but not yet executed by CI. Please add a Test step between Build and Pack in .github/workflows/build.yml:

      - name: Build
        run: dotnet build E4A.PostGuard.slnx --configuration Release

      - name: Test
        run: dotnet test E4A.PostGuard.slnx --configuration Release --no-build

      - name: Pack (dry run)
        run: dotnet pack src/E4A.PostGuard.csproj --configuration Release --no-build --output ./artifacts

--no-build reuses the Build step's output, so both TFMs are exercised without a second compile.

Note on overlap with #34

ChunkContentRange_IsFormattedPerChunk asserts the current exclusive range-end (bytes 0-1048576/*). #34 changes this to an inclusive end — when it lands, those two assertions need updating to bytes 0-1048575/* etc. Flagged inline in the test.

Refs #10

🤖 Generated with Claude Code

[dobby-coder]

Rules + review gatekeeper pass (cycle 1) — SIGN-OFF (posted as COMMENT)

Verdict is approve. Posted as COMMENT only because GitHub blocks approving a self-authored PR — treat this as a clean sign-off, not a withheld review.

Reviewed against the full binding rule set (per-rule check over the rule set) and merged with the upstream code review. The diff is test-only — five new xUnit files plus a recording HttpMessageHandler — and accurately mirrors the source behaviour. All 54 tests pass on net10.0 and both target frameworks compile. No blocking issues.

Two non-blocking notes (do not block merge):

• CI not yet running the tests — .github/workflows/build.yml still runs only Build + Pack. The test project is in the .slnx so it compiles in CI, but the 54 tests never execute. The bot lacks workflows permission to push this; the PR body documents the exact Test step for a maintainer to apply. Pre-existing constraint, not a regression — no rework needed from the author.
• Overlap with #34 — flagged inline below.

Reviewer assigned (@rubenhensen). Refs #10 is intentionally correct here rather than a closing keyword: this PR delivers the tests but not the CI wiring (a maintainer follow-up), so #10 should stay open until that lands.

[dobby-coder]

Non-blocking / awareness only: this asserts the current exclusive Content-Range end (bytes 0-1048576/*). Open PR #34 changes the SDK to an inclusive end (bytes 0-1048575/*); when #34 merges, this assertion and the one below will need updating. The author already flagged it in the inline NOTE — no action needed in this PR.