refactor(tests): standardize to node:assert/strict and t.after() per CONTRIBUTING.md (#1675)

* refactor(tests): standardize to node:assert/strict and t.after() per CONTRIBUTING.md

- Replace require('node:assert') with require('node:assert/strict') across
  all 73 test files to enforce strict equality (no type coercion)
- Replace try/finally cleanup blocks with t.after() hooks in core.test.cjs
  and hooks-opt-in.test.cjs per the test lifecycle standards
- Utility functions in codex-config and security-scan retain try/finally
  as that is appropriate for per-function resource guards, not lifecycle hooks

Closes #1674

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* perf(tests): add --test-concurrency=4 to test runner for parallel file execution

Node.js --test-concurrency controls how many test files run as parallel child
processes. Set to 4 by default, configurable via TEST_CONCURRENCY env var.
Fixes tests at a known level rather than inheriting os.availableParallelism()
which varies across CI environments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): allowlist verify.test.cjs in prompt-injection scanner

tests/verify.test.cjs uses <human>...</human> as GSD phase task-type
XML (meaning "a human should verify this step"), which matches the
scanner's fake-message-boundary pattern for LLM APIs. This is a
false positive — add it to the allowlist alongside the other test files
that legitimately contain injection-adjacent patterns.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/prompt-injection-scan.sh

@@ -72,6 +72,7 @@ ALLOWLIST=(
   'tests/security-scan.test.cjs'
   'tests/security.test.cjs'
   'tests/prompt-injection-scan.test.cjs'
+  'tests/verify.test.cjs'
   'get-shit-done/bin/lib/security.cjs'
   'hooks/gsd-prompt-guard.js'
   'SECURITY.md'

scripts/run-tests.cjs

@@ -19,8 +19,12 @@ if (files.length === 0) {
   process.exit(1);
 }
 
+const concurrency = process.env.TEST_CONCURRENCY
+  ? `--test-concurrency=${process.env.TEST_CONCURRENCY}`
+  : '--test-concurrency=4';
+
 try {
-  execFileSync(process.execPath, ['--test', ...files], {
+  execFileSync(process.execPath, ['--test', concurrency, ...files], {
     stdio: 'inherit',
     env: { ...process.env },
   });