Extend release and crosscompile security coverage

[matveynator]

Summary

• verify stable release artifact allowlists and fail-closed workflow behavior
• prove mail delivery failures never log secret-bearing error details
• exercise crosscompile macOS packaging, Docker/rsync orchestration, artifact validation, and full server target publication with command doubles

Validation

• targeted security tests pass for mailout, accountauth, channelacme, and crosscompile
• mailout remains above 90% coverage
• accountauth remains above 90% coverage
• channelacme and crosscompile are improved with meaningful platform/error-path coverage, but remain below 90%; the remaining gap is documented rather than filled with synthetic tests
• race testing was unavailable in this environment because gcc is not installed

[matveynator]

Added and validated the next reverse-order security slice.

Local results:

• go test ./pkg/mailout ./pkg/accountauth ./pkg/channelacme ./scripts/crosscompile passes.
• mailout: 90.6% coverage.
• accountauth: 90.3% coverage.
• channelacme: 85.7% coverage.
• crosscompile: 85.4% coverage after adding meaningful macOS/Docker/rsync/artifact orchestration tests.
• -race could not run in this environment because gcc is unavailable.

Merge is currently blocked by the repository-required CodeQL check waiting for results on this commit; no bypass was used.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!