Add -- to grep -qF in assert_contains/assert_not_contains so a --flag needle is compared, not parsed as an option (#214)

[fdaviddpt]

Closes #214

What was broken

assert_contains()/assert_not_contains() are duplicated inline across tests/*.sh, and the shape was grep -qF \"$expected\" <<<\"$output\" with no -- separator. A needle beginning with -- (exactly the --flag needs a target shape this repo's CLI-heavy suites reach for constantly) is parsed by grep as an option, grep exits non-zero on a usage error, and the helper -- which branches only on exit status -- cannot tell that apart from a genuine no-match. assert_not_contains is the dangerous direction: it reported PASS having compared nothing.

The decision this issue left open

The issue named two routes -- add -- everywhere, or centralise the helper -- and declined to pick. I took the mechanical sweep, not centralisation, for a structural reason rather than a preference: tests/test-assertion-helpers.sh (the meta-suite that already drives every suite's real helpers) extracts each suite's function body by reading the file and sourcing the extracted text. A shared/sourced helper would leave nothing for that extractor to find in each suite file, collapsing its DROVE count toward zero and breaking the DROVE < 20 floor it already enforces. The sweep is the route that does not fight that architecture.

What changed

• 16 of the 26 files defining assert_contains/assert_not_contains lacked the -- separator (9 already had it, one -- test-marker-degradation.sh -- uses a case glob match and was never affected). All 16 now pass -- before the needle in every grep -qF/grep -q call inside those two helpers.
• tests/test-assertion-helpers.sh gained a ---prefixed-needle payload (DASHNEEDLE/DASHBIG/DASHBIGFILE), driven through the existing capture/file:*/path-arg × contains/not_contains branches in drive_declared(), in both directions. A reintroduced missing -- is now caught structurally rather than waiting to be tripped over again.
• changelog.d/214.fixed.md.

Test evidence

Red (before the 16-file fix, with only the new DASHNEEDLE fixture added to the meta-suite): Results: 269 passed, 30 failed, all 30 failures the expected assert_contains should report PASS / assert_not_contains should report FAIL pairs across exactly the 16 broken files.

Green (after): Results: 299 passed, 0 failed.

bash tests/run-all.sh (the repo's test_command): All suites passed.

Scope note

assert_confined() in tests/test-pre-path-hook.sh has the same unguarded grep -q \"$forbidden\" shape and was not touched -- every call site passes a fixed literal rule name (\"i18n rules\", \"leaf rule\"), never a ---prefixed value, so it is not reachable with today's test data and is out of #214's stated scope (assert_contains/assert_not_contains specifically). Flagging it here as a below-bar finding rather than silently leaving it: a real latent shape, no reachable caller today.

Verified by the maintainer

Red re-run, independent of the agent's. Checked out db0c07f (current main, which contains #222) into a detached worktree, dropped in this branch's tests/test-assertion-helpers.sh alone, and ran it with the 16-file sweep absent: Results: 277 passed, 30 failed. Same 30 failures the agent reported; my pass count differs (277 vs 269) only because my base carries #222's three extra suites. The fixture is not vacuous.

The sweep is complete after the rebase, which was not obvious at dispatch. This branch was cut from 3b13092, before #222 merged, so it never saw test-block-framing.sh, test-jit-match.sh or test-sample-call-log.sh. I briefed the lane not to touch them and flagged that the sweep might therefore land incomplete. Checked directly: all three already carry grep -qF --, so there is no gap to close after rebasing onto main.

Blast radius against the true merge-base (3b13092..fix/214, not against main, which mixes in #222's reverse diff): 17 files — the 16 swept suites, the meta-suite, and changelog.d/214.fixed.md. Nothing outside tests/. None of #222's three files touched, so the lane held.

On the centralisation route being declined: I accept the argument as stated. test-assertion-helpers.sh extracts each suite's helper body by reading the file and sourcing the extracted text, and enforces a DROVE < 20 floor — a sourced shared helper leaves that extractor nothing to find per suite. That is a structural reason, not a preference, and it is the one I would have wanted named.

On the assert_confined() below-bar item: accepted as below the bar. Every call site passes a fixed literal rule name, so it is unreachable with today's test data. Recorded here rather than filed, per the receipt rule.