fix: do not fail the suite when there is no trace to redact

The redaction added two commits ago took TestMain down with it in CI:

    could not redact .../playwright-traces/TestMain.zip, removing it:
      no such file or directory
    Error: remove .../TestMain.zip: no such file or directory

Two mistakes. A trace that was never written cannot leak anything, so a
missing archive is nothing to redact rather than an error, and removing
an already-absent file is not a failure either — only a trace still on
disk afterwards is worth failing over.

The second mistake is what produced the missing file. Every package's
TestMain traces under the same name into one shared directory, so the
packages `go test ./...` runs in parallel were already overwriting each
other's traces; rewriting one then raced the next writer, and a failed
rewrite deleted the file out from under it. Trace names are now
qualified by package, which removes the race and stops the traces from
clobbering each other — worth having on its own, given these traces are
the only record of what the browser did.

Verified with two browser-login packages in parallel and a dummy
ORY_RATE_LIMIT_HEADER: both complete, each writes its own trace
(identity.TestMain.zip, relationtuples.TestMain.zip), both hold zero
occurrences of the value, and the header still reaches only the console
hosts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tg5VWFUb7824qkrooUdvBA

Author: alnr

cmd/cloudx/testhelpers/redact_test.go

@@ -103,4 +103,11 @@ func TestRedactInZip(t *testing.T) {
 
 		assert.Error(t, redactInZip(path, secret))
 	})
+
+	t.Run("case=a missing archive is not an error", func(t *testing.T) {
+		// Tracing does not always leave a file behind, and an archive that was
+		// never written cannot leak anything. Treating it as a failure took the
+		// whole TestMain down with it.
+		assert.NoError(t, redactInZip(filepath.Join(t.TempDir(), "absent.zip"), secret))
+	})
 }

cmd/cloudx/testhelpers/testhelpers.go

@@ -8,8 +8,10 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"net/http"
 	"net/url"
 	"os"
@@ -355,7 +357,11 @@ func routeRateLimitHeader(t testing.TB, page playwright.Page) {
 // If it cannot be rewritten the trace is deleted: losing a diagnostic is the
 // cheaper failure by far.
 func stopTracing(t testing.TB, page playwright.Page) {
-	path := filepath.Join(tracesDir, fmt.Sprintf("%s.zip", t.Name()))
+	// The name is qualified by package because every package's TestMain traces
+	// under the same test name into one shared directory: unqualified, the
+	// packages `go test ./...` runs in parallel overwrite each other's traces,
+	// and rewriting one races the next writer.
+	path := filepath.Join(tracesDir, fmt.Sprintf("%s.%s.zip", tracesPackage, t.Name()))
 	if err := page.Context().Tracing().Stop(path); err != nil {
 		t.Logf("tracing stop error: %+v", err)
 		return
@@ -365,9 +371,17 @@ func stopTracing(t testing.TB, page playwright.Page) {
 	if !ok {
 		return
 	}
-	if err := redactInZip(path, secret); err != nil {
-		t.Logf("could not redact %s, removing it: %+v", path, err)
-		require.NoError(t, os.Remove(path))
+
+	err := redactInZip(path, secret)
+	if err == nil {
+		return
+	}
+
+	// The archive could not be rewritten, so make sure it cannot be uploaded.
+	// Only a trace that is still on disk afterwards is worth failing over.
+	t.Logf("could not redact %s, removing it: %+v", path, err)
+	if err := os.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		require.NoError(t, err, "the trace may still carry the rate-limit header")
 	}
 }
 
@@ -392,6 +406,10 @@ func redactInZip(path, secret string) error {
 	}
 
 	r, err := zip.OpenReader(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		// Tracing wrote no archive, so there is nothing that could leak.
+		return nil
+	}
 	if err != nil {
 		return err
 	}
@@ -520,13 +538,19 @@ func PlaywrightAcceptConsentBrowserHook(t testing.TB, page playwright.Page, emai
 	}
 }
 
-var tracesDir string
+var (
+	tracesDir string
+	// tracesPackage is the package under test, used to keep the traces of
+	// packages running in parallel apart. See stopTracing.
+	tracesPackage string
+)
 
 func init() {
 	cwd, err := os.Getwd()
 	if err != nil {
 		panic(err)
 	}
+	tracesPackage = filepath.Base(cwd)
 	dirs := strings.Split(cwd, string(os.PathSeparator))
 	for i := range dirs {
 		if dirs[i] == "cloudx" {