Error-handling hygiene audit (panics and silent errors)

[valentina2509]

Error-handling hygiene audit — panics and silent errors

This is a tracking issue for a cluster of defects where errors are either
silently swallowed or cause a process panic instead of being surfaced to the
caller with a meaningful diagnostic.

Child issues and related items

Item	Locus	Status
#15 — CLI panics on malformed IPC header	lore/src/remote/message.rs:52 — .unwrap()	PR #16 open
#60 — Opaque Internal Error on Entra JWKS	lore-server/src/auth/jwk.rs:141,146 — no warn!() before ok_or(InternalError)?	PR #65 open
(untracked) JWK cache never refreshes	lore-server/src/auth/jwk.rs:89 — desired.map(…).is_some() invariantly true	No PR — highest priority
PR #49 — JWT auth bypass	lore-server auth helpers — empty permission lists treated as authorised	PR #49 is the fix

Shared pattern

Every item in this cluster has the same root: an absent or inadequate error
signal at a point where the code transitions from a valid state to an
unexpected one. The result is either a crash (panic at message.rs:52) or an
opaque failure that gives the operator no information to act on.

Fix directions

1. message.rs:52: replace .unwrap() with ? — one character, no behaviour change for valid input, converts panic to propagated error. (PR lore: return an error on a malformed IPC message header #16 in flight.)
2. jwk.rs:141,146: add warn!() before each ok_or(InternalError)?, naming the missing field. (PR fix(auth): infer RS256 from RSA+sig when JWK alg is missing #65 in flight.)
3. jwk.rs:89: .map → .and_then. This is a security-significant bug (key rotation is broken after startup) and has no open PR. It should be filed and merged before coordinating the adjacent auth PRs (fix(auth): infer RS256 from RSA+sig when JWK alg is missing #65, lore-server: Enforce repository write permissions #49).
4. PR lore-server: Enforce repository write permissions #49 addresses the auth bypass; it should be reviewed and merged after the cache fix lands, as both touch authentication paths.

Background

Identified in the open-bug theme analysis (triage/2026-06-bug-theme-analysis.md,
branch valentina2509:docs/bug-theme-analysis).