[quality] test: cover buildAgentMinter mint-credential bootstrap (src/cmd/hive/main.go)

[kubestellar-hive]

Test Improvement

Adds src/cmd/hive/build_agent_minter_test.go covering buildAgentMinter (src/cmd/hive/main.go:890), previously 0% covered despite sitting on the per-agent mint-credential path (0% → 93.3%):

• fail-closed validation: missing mint.key_path and missing mint.issuer (and that issuer validation fails before any key file is created)
• corrupt signing key surfaces a loading mint signing key error instead of silently regenerating (which would orphan outstanding tokens)
• key bootstrap creates the signing key with 0600 perms; mint round-trip issues a token and rejects an empty agent name
• rebuild against the same path reuses the persisted key
• MaxTTLSeconds=0 falls back to the package default and still mints

Claimed ground: buildAgentMinter in src/cmd/hive/main.go only — disjoint from open PR #5665 (labelPlanSink / planFromLabeledIssues in src/cmd/hive/plan_from_label_sink_test.go).

Verified: go test -run TestBuildAgentMinter ./cmd/hive/ passes; full ./cmd/hive suite unaffected.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5 copilot=1.0.78

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[clubanderson]

Review — OK to merge on green. Checked the assertions against buildAgentMinter in src/cmd/hive/main.go — error strings and validation order match the production path, and the invariants are real ones, not line-coverage filler:

• Fail-closed on missing mint.key_path / mint.issuer, with the issuer case additionally proving validation fails before any key file is created (ordering, not just presence).
• Corrupt key surfaces the loading mint signing key wrap instead of silently regenerating — the invariant that actually protects outstanding tokens, and the reuse test pins the other half (second build against the same path must not rotate the key).
• 0600 on the bootstrapped key, empty agent name refused, MaxTTLSeconds=0 falls through to the package default.

On the mint-deadlock incident class: these tests call buildAgentMinter directly with temp-dir key paths and take no locks at all — same shape as production (the function itself is lock-free; the deadlock zone was hub-side). No test-only locking that could mask or invert a production lock order. Scope claim holds: one new file, disjoint from #5665.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey