- Delete models_test.go entirely: all assertions tested Go language
  guarantees (zero values, struct construction), not production behavior
- Delete TestAgentFramedDescriptionConvention: tested its own string
  literals, not any production code path
- Delete TestSecretConstants + TestK8SWildcardPrefix: constants-equal-
  their-own-value checks provide no regression protection
- Collapse TestFinancial_Stripe/Voyage/MLKeys/CloudBilling/AWSAdmin into
  TestFinancial_Weights table; TestMutation_CloudOwner/K8sWildcard/
  K8sProdContext/GitHubToken into TestMutation_Weights table
- Merge TestMarkdownFormatter_Heading + TestMarkdownFormatter_RiskScores
  into single TestMarkdownFormatter_Structure test
- Add localScan() helper to local_test.go; apply to all 15 tests that
  repeated the 4-line scanner setup boilerplate

Coverage unchanged: 89.5% total

- Delete IsHighRiskEnvKey() (one call site replaced with direct map lookup)
- Delete mockDispatch, skipReason, containsAll helpers (defined, never called)
- Delete TestHighRiskEnvKeyCount (count guard that blocks adding new keys)
- Rename TestAPIKeyScanner_HighRiskEnvKeysSliceContainsKnownKeys (stale 'Slice')
- Collapse TestCompute_EmptyReturnsAllThreeScores: 9 if-statements → loop (30→15 LOC)
- Merge TestSecretExposure_{PerEnvKey,GACCountsOnce,EnvFile} → single table test
- Split TestSecretExposure_UsesExplicitSetNotNamingHeuristic: heuristic cases → 2-row
  table, cap case → dedicated TestSecretExposure_ScoreCappedAt10

Coverage: 89.6% (baseline 89.5%)

…ract renderJSON

- Add localScanInDir(dir, run, toolAvail) helper in local_test.go; localScan
  delegates to it; 6 Terraform/.env tests collapse from 4-line setup to 1 line
- Table-drive AWS/Azure/GCP skip-condition tests (9 individual tests → 3 tables)
- Delete TestAzureScanner_SkipReasonDereferenced (covered by new table); remove
  now-unused fmt import from azure_test.go
- Table-drive ParseARN: 4 individual tests → single TestParseARN table
- Extract renderJSON(t, report) helper in formatters_test.go; apply to 4 JSON
  tests to eliminate repeated var buf + Render + error-check boilerplate
- Merge TestJSONFormatter_NoANSICodes + TestMarkdownFormatter_NoANSICodes ->
  TestFormatters_NoANSICodes table (JSON + Markdown subtests)

Coverage: 89.6% (baseline 89.5%)

- TestJSONFormatter_FindingFields: restore Description and Detail fields
  that were silently dropped in the previous refactor
- Split TestFormatters_NoANSICodes back into TestJSONFormatter_NoANSICodes
  and TestMarkdownFormatter_NoANSICodes; the merged closure-based version
  was more complex than the two simple originals it replaced

- Delete TestSentinelConstants: tests implementation detail (literal values
  -1/-2) not behavior; skip-condition tables already cover the behaviors
  those constants gate
- Delete TestAPIKeyScanner_NeverSkipped: fully covered by the skipped=false
  assertions inside DetectsEnvKey, EmptyEnvNoFindings, and
  NoCredentialFileNoFinding
- TestAPIKeyScanner_EmptyEnvNoFindings: replace nonexistent-home-path hack
  with t.TempDir() so we can assert len(findings)==0 cleanly instead of
  spot-checking two specific resource names

The // ---...--- divider pattern is not idiomatic Go. Test function names
and blank lines provide sufficient grouping. Removed divider lines across
all test files in scan/, output/, and scoring/.

The // ---...--- divider pattern is not idiomatic Go. Test function names
and blank lines provide sufficient grouping. Also removed a few stale
inline comments made redundant by the surrounding code.