test: integration coverage report, suite docs and harness isolation fix

tests/integration/test_sweep.py

@@ -29,7 +29,9 @@ def sweep_context(gitea: GiteaInstance, regular_user: RegularUser) -> Ctx:
     return seed(gitea, regular_user.login, regular_user.token)
 
 
-async def test_every_tool_reaches_gitea(mcp: McpSession, sweep_context: Ctx) -> None:
+async def test_every_tool_reaches_gitea(
+    mcp: McpSession, sweep_context: Ctx, gitea: GiteaInstance, regular_user: RegularUser
+) -> None:
     catalog = load_catalog()
     listed = {tool.name for tool in (await mcp.client.list_tools()).tools}
     expected = {op.tool_name for op in catalog.operations} | {RAW_TOOL}
@@ -52,3 +54,20 @@ async def test_every_tool_reaches_gitea(mcp: McpSession, sweep_context: Ctx) ->
     assert not bad, f"{len(bad)} tool(s) with an unexpected result ({summary}):\n{report}"
     success_share = summary.get("success", 0) / len(records)
     assert success_share >= MIN_SUCCESS_SHARE, f"only {success_share:.0%} of tools got a 2xx"
+
+    # Whatever the 538 calls did, no credential or secret value came back in a result.
+    hidden = [
+        gitea.admin_token,
+        gitea.admin_password,
+        regular_user.token,
+        regular_user.password,
+        "rotated-org-value",
+        "rotated-repo-value",
+        "rotated-user-value",
+        "org-secret-value",
+        "repo-secret-value",
+        "user-secret-value",
+    ]
+    for value in hidden:
+        assert all(value not in text for text in mcp.texts), "a secret leaked into a result"
+        assert value not in mcp.audit_text(), "a secret leaked into the audit log"