test: unit tests via httptest, concurrent stress, fork scenarios, benchmarks

[neverDefined]

Phase 3 PR F — fills the test-depth gaps.

Summary

Four new files plus subtests in the existing integration harness, adding +705 lines of test code.

`anvil_unit_test.go` — pure-Go, no live anvil (#47)

Runs without Foundry installed. Covers:

• Builder validation — table-driven cases for `validate()`; `WithStartupTimeout` semantics (positive wins, zero/negative ignored); default propagation through `Build()`.
• `resolveAnvilPath` — temp-dir fixtures for five scenarios: missing fallback (`ErrAnvilNotFound`), not-executable file (`ErrAnvilNotExecutable`), directory at expected path (`ErrAnvilNotExecutable`), executable fallback (success), `XDG_CONFIG_HOME` precedence over `HOME`. Skipped on Windows (POSIX-only check).
• `retry` helper — success on first, success after N retries, attempts exhausted.
• Error sentinels — `errors.Is` propagation through `fmt.Errorf("%w", ...)` for every `Err*` value.
• RPC method shape via httptest — a recording JSON-RPC server asserts each RPC wrapper sends the right method and the right params. Covers all 17 mutating methods. Plus a ctx-cancel mid-call test against a slow server.

Contributors without Foundry can run the unit subset:

```
go test -run '^Test(AnvilBuilder|ResolveAnvilPath|Retry|SentinelErrors|RPC)' ./...
```

`anvil_test.go` — new integration subtests (#48)

• `Test StartupTimeout exceeded` — builds with `WithStartupTimeout(1ms)`, expects `ErrStartupTimeout` from `Start()`.
• `Test RPC ctx canceled` — cancels ctx, expects `context.Canceled` from an RPC call.
• `Test Concurrent RPC calls` — 50 goroutines doing mixed `MineBlock` / `SetBalance` / `Metrics` reads for ~500ms; asserts metrics grew monotonically under concurrent load. Passes under `-race`.

`fork_test.go` — `//go:build fork` tag (#48)

Reads `ETH_RPC_URL` from env; skips cleanly if unset. CI default runs without the tag. Run locally:

```
ETH_RPC_URL=https://... go test -tags=fork -run Fork ./...
```

Covers `WithFork` at chain head and `WithForkBlockNumber` at a specific block.

`anvil_bench_test.go` — benchmarks (#48)

Four benchmarks backing the existing `make bench` target:

```
BenchmarkMineBlock-16 ~283 µs/op
BenchmarkSetBalance-16 ~195 µs/op
BenchmarkSnapshotRevertCycle-16 ~253 µs/op
BenchmarkResetState-16 ~380 µs/op
```

(Apple M4, localhost anvil 1.5.0.)

`.golangci.yml` — added `gosec` to `_test\.go` exclusions

Test fixtures legitimately create executable files (mode 0o755) which gosec G306 flags in production code. Not a concern in test-only code.

Test plan

• `go build ./...` + `go build -tags=fork ./...` clean
• `go vet ./...` clean
• `golangci-lint run ./...` — 0 issues
• `go test -race ./...` — all 24 subtests + 17 unit-RPC subtests + 3 new subtests green, ~24s
• Benchmarks run clean with `-benchtime=2x`
• CI matrix all four slots green + vuln + lint

Scope notes

• No API changes.
• No code changes in `anvil.go` or `helpers.go` — tests only.
• `bloop` hints (`b.Loop()` for benchmarks) and `rangeint` hints (`for i := range N`) left as idiomatic-old-style to match existing codebase. Can sweep in a later cleanup.

Closes #47
Closes #48

What's left

• PR G: `.claude/` AI tooling ([phase-3] add .claude/ AI tooling (agents, commands, hooks) #49) and scheduled remote agents ([phase-3] set up scheduled remote agents (weekly dep/Foundry check + triage) #50). You still owe me a decision on [phase-3] set up scheduled remote agents (weekly dep/Foundry check + triage) #50 (billed per run) — happy to defer or cut scope.

🤖 Generated with Claude Code