fix: address foundation scrutiny findings

- Make CI smoke commands Windows-aware by using OS-neutral cargo run invocations
- Replace masked negative smoke checks (|| true) with explicit non-zero assertions
- Remove Cargo.lock from .gitignore and track for binary reproducibility
- Strengthen secret redaction to eliminate stable first/last character leakage
- Remove readme field from Cargo.toml that referenced a missing README.md

.github/workflows/ci.yml

@@ -92,19 +92,26 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo build --release
+      # OS-neutral cargo-based smoke tests avoid path issues on Windows (.exe vs no extension)
       - name: rustunnel --help
-        run: target/release/rustunnel --help
+        run: cargo run --release -- --help
       - name: rustunnel version
-        run: target/release/rustunnel version
+        run: cargo run --release -- version
       - name: rustunnel listen --help
-        run: target/release/rustunnel listen --help
+        run: cargo run --release -- listen --help
       - name: rustunnel connect --help
-        run: target/release/rustunnel connect --help
+        run: cargo run --release -- connect --help
       - name: rustunnel generate --help
-        run: target/release/rustunnel generate --help
+        run: cargo run --release -- generate --help
       - name: Invalid command fails
-        run: target/release/rustunnel invalid-cmd || true
+        run: |
-        shell: bash
+          if cargo run --release -- invalid-cmd 2>&1; then
+            echo "ERROR: invalid command should have failed"
+            exit 1
+          fi
       - name: Invalid port fails
-        run: target/release/rustunnel listen --listen localhost:bad --cert x --key x --ca-cert x --auth-token x || true
+        run: |
-        shell: bash
+          if cargo run --release -- listen --listen localhost:bad --cert x --key x --ca-cert x --auth-token x 2>&1; then
+            echo "ERROR: invalid port should have failed"
+            exit 1
+          fi

.gitignore

@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 **/*.pem
 **/*.json
 .env

Cargo.toml

@@ -4,7 +4,6 @@ version = "0.1.0"
 edition = "2024"
 description = "Cross-platform HTTPS mTLS lab/dev tunneling tool"
 license = "MIT"
-readme = "README.md"
 
 [dependencies]
 clap = { version = "4", features = ["derive"] }

src/redact.rs

@@ -30,15 +30,8 @@ impl fmt::Display for Redacted {
         let len = self.0.len();
         if len == 0 {
             write!(f, "[REDACTED]")
-        } else if len <= 4 {
-            write!(f, "[REDACTED(len={})]", len)
         } else {
-            write!(
+            write!(f, "[REDACTED(len={})]", len)
-                f,
-                "[REDACTED(len={}...{})]",
-                &self.0[..2],
-                &self.0[len - 2..]
-            )
         }
     }
 }