feat(usable): integrate current dbtool implementation snapshot

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/qa/test-failure-path-evidence-format.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+tmp_dir="$(mktemp -d)"
+output_dir="$tmp_dir/out"
+
+cleanup() {
+  rm -rf "$tmp_dir"
+}
+trap cleanup EXIT
+
+cat >"$tmp_dir/fake-dbtool" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+if [ "${1:-}" = "--version" ]; then
+  echo "fake-dbtool 0.1.0"
+  exit 0
+fi
+kind="authentication"
+for arg in "$@"; do
+  case "$arg" in
+    59999|59998)
+      kind="connection"
+      ;;
+    *failing_query.sql)
+      kind="query"
+      ;;
+  esac
+done
+printf '{"status":"error","state":"error","error":{"kind":"%s"}}\n' "$kind"
+exit 2
+EOF
+chmod +x "$tmp_dir/fake-dbtool"
+
+QA_HOST_LABEL="runner-host-01" \
+QA_BINARY_PATH_LABEL="./target/release/dbtool" \
+QA_BINARY_VERSION="dbtool 0.1.0" \
+QA_EXECUTION_PATH="host" \
+QA_COMMIT_SHA="deadbeefcafebabe" \
+QA_BRANCH_NAME="qa-fixture-branch" \
+"$root_dir/scripts/qa/run-failure-path-evidence.sh" \
+  "$tmp_dir/fake-dbtool" \
+  postgres \
+  "$output_dir" >/dev/null
+
+evidence_file="$output_dir/PG-CONN-AUTH-001.md"
+raw_file="$output_dir/PG-CONN-AUTH-001.out"
+[ -f "$evidence_file" ] || {
+  echo "expected evidence markdown not found: $evidence_file" >&2
+  exit 80
+}
+[ -f "$raw_file" ] || {
+  echo "expected raw output file not found: $raw_file" >&2
+  exit 81
+}
+
+expected_lines=(
+  '### PG-CONN-AUTH-001'
+  '- Date (UTC): `'
+  '- Operator: `qa-engineer`'
+  '- Host: `runner-host-01`'
+  '- Execution Path: `host`'
+  '- Binary Path: `./target/release/dbtool`'
+  '- Binary Version: `dbtool 0.1.0`'
+  '- Commit SHA: `deadbeefcafebabe`'
+  '- Branch: `qa-fixture-branch`'
+  '- Driver: `postgres`'
+  '- Scenario ID: `PG-CONN-AUTH-001`'
+  '- Command: `./target/release/dbtool connect --driver postgres'
+  '- Exit Code: `2`'
+  '- Key Output: `status=error, state=error, error.kind=authentication`'
+  'Output (excerpt):'
+  '```'
+  '{"status":"error","state":"error","error":{"kind":"authentication"}}'
+  'Verdict:'
+  '- Expected: non-zero exit, `status=error`, `state=error`, `error.kind=authentication`, no secret leakage'
+  '- Traceability check: `complete` (none)'
+  '- Secret leakage check: `not-detected` (exact)'
+  '- Actual: see output excerpt above'
+  '- Result: `pass`'
+)
+
+last_line=0
+for expected in "${expected_lines[@]}"; do
+  current_line="$(grep -nF -- "$expected" "$evidence_file" | head -n 1 | cut -d: -f1)"
+  if [ -z "$current_line" ]; then
+    echo "missing expected markdown line: $expected" >&2
+    exit 82
+  fi
+  if [ "$current_line" -le "$last_line" ]; then
+    echo "markdown order regression near: $expected" >&2
+    exit 83
+  fi
+  last_line="$current_line"
+done
+
+grep -Fq '{"status":"error","state":"error","error":{"kind":"authentication"}}' "$raw_file" || {
+  echo "raw output file content mismatch" >&2
+  exit 84
+}
+
+echo "failure-path markdown format fixture passed"