test(agent): collect tests/verify_*.py so CI runs the VULN regression suite

[schenksj]

Closes #38.

What

• Collect the regression suite. vulnhunter-agent/pyproject.toml now sets python_files = ["test_*.py", "verify_*.py"]. Before this change, none of the 11 tests/verify_NNN_*.py files (VULN-001…013, 51 tests) were collected by bare pytest, so CI never ran them. Keeping the verify_NNN names, rather than renaming the files, preserves their link to the findings.
• Make two verify_012 tests able to fail. test_bearer_header_redacted and test_access_token_query_redacted used ghp_-prefixed tokens. The raw-token-prefix pass masks those no matter what, so the Bearer and query-param passes had no effective test coverage. Disabling either pass in agent/_url.py left the whole suite green. They now use opaque tokens.
• Dropped an unused import pytest in verify_012 left over from Add client_secret redaction pass to credential scrubber #17.
• Stop verify_013 from leaking the process umask. Its tests call os.umask(0o022) and never restored the previous value. That didn't matter while the file wasn't collected, but now the changed umask would carry into every test that runs after it. An autouse fixture now saves and restores the umask. Checked under umask 077: a probe test that runs after verify_013 fails without the fixture and passes with it.

Verification

	Result
pytest on main	1139 passed, 0 collected from verify_*
pytest on this branch	1190 passed (+51, all verify_*), 1 skipped
Mutation: Bearer pass disabled	test_bearer_header_redacted fails (passed before this change)
Mutation: access_token query pass disabled	test_access_token_query_redacted fails (passed before this change)

All newly collected tests pass, so this adds coverage without breaking CI.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ schenksj
❌ xxxxxxxxxxxxx
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[srujan-2025]

Reviewed at 3ff5477. No blocking findings. Independently verified that collection adds all 51 security regression tests and the full agent suite passes (1,190 passed, 1 skipped). Confirmed the updated redaction tests detect disabled Bearer/query-token passes, and the umask fixture restores the caller’s setting even after test failure. The changes look correct and appropriately scoped.