[quality] test: pin IssueClosedAt finding-retirement semantics (src/pkg/github/client.go IssueClosedAt)

[kubestellar-hive]

Test Improvement

Adds src/pkg/github/issue_closed_at_test.go — the only file this PR claims — covering (*Client).IssueClosedAt in src/pkg/github/client.go, which was at 0% coverage.

IssueClosedAt is the lookup the advisory digest uses to retire findings whose named remediations (issues, hold-gated PRs) have landed — the #6080 fix. Its doc comment spells out a safety contract that nothing pinned:

• closed issue → (closedAt, true, nil)
• open issue → (zero, false, nil)
• 404 → (zero, false, nil) — "not found is not closed": the caller retires a finding only when every named reference is closed, so a vanished reference must keep the finding open (the safe direction)
• other errors → returned, so the caller can distinguish "open" from "could not tell"
• nil receiver → ErrNoGitHubClient

A regression turning a 404 or 500 into "closed" would silently retire live findings from the digest. Five tests via the existing newTestClient httptest pattern.

Verified: go test -run TestIssueClosedAt ./pkg/github/ — 5/5 PASS; new tests are hermetic (httptest only, no env, no network).

Overlap check

Disjoint from all open hold-gated PRs: #6334 touches client.go but only EnumerateActionable/fetchIssues/work-breakdown; #6330 is pkg/agent; #6327 is pkg/hub; #6292 is dashboard local-mode; #6337/#6336 are docs/discord.

Related bead

7dec0836-b26 (coverage-gap, priority 1)

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback