Add comprehensive test coverage for utils and cmd packages

[kerren]

Summary

This PR implements Phase T0, T2, and T3 of the testing plan outlined in docs/testing-plan.md, adding extensive test coverage for the utils and cmd packages. The changes include 13 new test files covering previously untested functions and adding CI hygiene guards.

Key Changes

• New test files for utils package:

  • build_image_buildx_subprocess_test.go — 580 lines of subprocess integration tests using a fake docker shim to verify argument assembly, environment variable handling, credential isolation, and output streaming
  • hash_watch_directories_test.go — Tests for directory hashing with exclusion patterns
  • hash_watch_files_test.go — Tests for file hashing with order invariance
  • read_dockerignore_test.go — Tests for .dockerignore parsing and pattern handling
  • detect_buildx_test.go — Tests for buildx detection and version parsing
  • extract_version_test.go — Tests for version file extraction
  • hash_string_test.go — Tests for SHA256 hashing with known vectors
  • generate_docker_image_name_test.go — Tests for image name generation
  • parse_version_file_json_test.go — Tests for JSON version parsing
  • remove_empty_strings_from_array_test.go — Tests for array filtering
  • stdout_purity_test.go — Source-reading guard ensuring stdout remains pure outside write_build_output.go

• New test file for cmd package:

  • readme_flag_coverage_test.go — Mechanical enforcement that every build flag is documented in README.md

• CI hygiene:

  • .github/workflows/hygiene.yaml — New workflow that asserts no plan.md exists in the repository root (planning documents belong in docs/)

• Documentation updates:

  • docs/testing-plan.md — Updated coverage percentages (utils: 38.2% → 52.6%, cmd: 0.0% → 33.8%) and marked completed phases

Notable Implementation Details

• The subprocess tests in build_image_buildx_subprocess_test.go use a POSIX shell script fake docker executable to record argv, environment, and working directory without touching a real Docker daemon or registry
• Tests are designed to be non-parallel where they manipulate process-global state (PATH, environment variables, os.Stdout/os.Stderr)
• The stdout purity test uses regex scanning of source files to enforce the convention that only write_build_output.go writes to stdout
• All new tests follow the existing pattern of pure unit tests (no registry, no credentials) except where subprocess interaction is required
• Tests pin known edges and currently-silent behaviors documented in the testing plan, making them explicit rather than implicit

https://claude.ai/code/session_01Tn4Aqbe88wWU6a5njxB8dA