git-remote-entire: document TLS-skip caveat; test empty advertised cores
Commit
Soph3mo ago
- Note in the resolveEnvTokenCreds SECURITY comment that the trust gate is only as strong as TLS verification: ENTIRE_TLS_SKIP_VERIFY degrades it, so it must not be combined with ENTIRE_TOKEN in CI.
- Add TestResolveEnvTokenCreds_EmptyAdvertisedCoresAborts: discovery returning HTTP 200 with an empty core_urls list must fail closed, not trust the aud.
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com Entire-Checkpoint: 7ab4d9667f78