fix(sdk/go): strip credential headers on cross-host redirect

[AbirAbbas]

Summary

The Go SDK control-plane client (sdk/go/client) attaches the operator's credentials as custom request headers — X-API-Key, and when DID auth is configured X-Caller-DID / X-DID-Signature / X-DID-Timestamp / X-DID-Nonce — on an http.Client that follows redirects with no CheckRedirect policy.

Go's net/http strips Authorization, Cookie, Cookie2 and WWW-Authenticate when following a redirect to a different host, but it does not strip arbitrary application headers. So if the configured baseURL returned a cross-host redirect, the client would replay X-API-Key (and the DID headers) to the redirect target. Authorization set via WithBearerToken was already stripped by the stdlib; the gap was the custom headers.

Fix

• Add a CheckRedirect hook (stripSensitiveHeadersOnRedirect) that removes every credential header the client attaches when a redirect targets a host other than the originally configured one. The comparison is against via[0] so credentials only ever reach the operator-configured host, even across a multi-hop redirect chain.
• Same-host redirects keep the headers, so ordinary redirect following (e.g. a trailing-slash or path redirect) is unchanged.
• The credential list is sourced from the existing did_auth header constants so it can't drift if a header is renamed.
• Applied to both the default client and clients passed via WithHTTPClient that don't already define their own redirect policy.

Tests

• TestStripsCredentialsOnCrossHostRedirect — end-to-end: a cross-host 302 no longer leaks X-API-Key / Authorization.
• TestKeepsCredentialsOnSameHostRedirect — same-host redirect still carries the credential (no regression).
• TestSendsCredentialsWithoutRedirect — baseline, no redirect.
• TestStripSensitiveHeadersOnRedirectUnit — deterministic coverage of the full 6-header credential set; also asserts non-credential headers (e.g. Accept) are preserved.

Full sdk/go suite passes; gofmt and go vet clean on the changed files.

Refs GHSA-jp8j-g39q-qxwx.

🤖 Generated with Claude Code

---

Also included: control-plane coverage CI fix

Second commit (fix(handlers): stop flaky coverage CI from global-logger race). Pre-existing flake on main, unrelated to the SDK change but folded in to keep this to a single PR.

TestDiscoveryLoggingIncludesOptionalRequestID and TestExecutionCleanupService_StartStopBranches both swap the process-global logger.Logger (via setupExecutionCleanupTestLogger) while running t.Parallel(); a sibling test reassigned the global mid-run, emptying the captured buffer and failing the coverage (control-plane) job (which cascaded into coverage-summary). Fix drops t.Parallel() from both, matching the existing non-parallel logger-swapping tests in execution_cleanup_test.go. Verified with a 20x stress run of the previously-failing command; coverage jobs went green on the dedicated branch before folding in.

Separate pre-existing -race-only data races in the heartbeat coverage tests were observed but left for a follow-up (CI does not run -race).

[github-actions]

Performance

SDK	Memory	Δ	Latency	Δ	Tests	Status
Go	218 B	-22%	0.60 µs	-40%	✓	✓

✓ No regressions detected

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 86%, aggregate ≥ 88%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	87.50%	87.30%	↑ +0.20 pp	🟡
sdk-go	92.00%	90.70%	↑ +1.30 pp	🟢
sdk-python	93.73%	93.63%	↑ +0.10 pp	🟢
sdk-typescript	92.80%	92.56%	↑ +0.24 pp	🟢
web-ui	89.93%	90.01%	↓ -0.08 pp	🟡
aggregate	89.03%	89.01%	↑ +0.02 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	0	—	➖ no changes
sdk-go	13	100.00%	✅
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.