test(processor): guard -update against CI misuse; drop agent report md

docs/superpowers/plans/task-1-report.md

@@ -1,60 +0,0 @@
-# Task 1 Report — Inject `cfg` into file-mutating methods
-
-## Files changed
-
-- `internal/processor/processor.go`
-  - `Process()`: now loads `cfg` once (`config.Load()` / fallback `config.Default()`) for the non-git path and threads it into `processDirectory` and `processFile`.
-  - `processDirectory(dirPath string, cfg *config.Config) error` — new `cfg` param, forwarded to `processFile`.
-  - `processFile(filename string, cfg *config.Config) error` — new `cfg` param, forwarded to `processFileInMemory`.
-  - `processFileInMemory(filename string, language types.Language, cfg *config.Config) error` — removed internal `config.Load()` block; `cfg` now supplied by caller.
-- `internal/processor/git_processor.go`
-  - `processGitChanges()`: now loads `cfg` once (`cfg, _, cfgErr := config.Load()` / fallback `config.Default()`) right before `totals := &GitTotals{}`, and passes it into `processFileWithLineRanges` on the non-dry-run path.
-  - `processFileWithLineRanges(filename string, lineRanges []git.LineRange, cfg *config.Config) error` — removed internal `config.Load()` block; `cfg` now supplied by caller.
-- `internal/ignore/ignore.go` — incidental: `go fmt` (run as part of `make check`) stripped trailing whitespace on 3 blank lines. No syntactic change (`jj diff` confirms "No syntactic changes"); not part of the planned refactor scope.
-
-`showPreview` and `showGitPreviewWithTotals` were left untouched — both keep their own `config.Load()` calls per the plan.
-
-Used the `cfgErr` variant in `processGitChanges` (per the plan's fallback note) since `err` was already declared earlier in that function via the `switch` block.
-
-## `go test ./...` output (after refactor)
-
-```
-ok  	github.com/carlosarraes/shush/cmd/shush	(cached)
-?   	github.com/carlosarraes/shush/internal/cli	[no test files]
-?   	github.com/carlosarraes/shush/internal/commands	[no test files]
-?   	github.com/carlosarraes/shush/internal/config	[no test files]
-ok  	github.com/carlosarraes/shush/internal/git	(cached)
-?   	github.com/carlosarraes/shush/internal/guide	[no test files]
-?   	github.com/carlosarraes/shush/internal/hooks	[no test files]
-?   	github.com/carlosarraes/shush/internal/ignore	[no test files]
-ok  	github.com/carlosarraes/shush/internal/processor	(cached)
-?   	github.com/carlosarraes/shush/internal/types	[no test files]
-```
-
-## `make check` result
-
-Ran `go fmt ./...` (reformatted `internal/ignore/ignore.go`, whitespace-only), `go vet ./...` (clean, no output), `go test -v ./...` — all suites passed:
-- `cmd/shush`: `TestGitFlagValidation` and all 10 subtests — PASS
-- `internal/git`: `TestParseGitDiffUnified` (6 subtests), `TestIsInLineRanges` (13 subtests), `TestIsInLineRangesEmptyRanges` — PASS
-- `internal/processor`: `TestRemoveCommentsFromLine` (8 subtests), `TestFindCommentIndex` (7 subtests), `TestLineHasComment` (5 subtests) — PASS
-
-Overall: `make check` exited clean — zero failures, zero vet warnings.
-
-## New method signatures
-
-```go
-func (p *Processor) processFileInMemory(filename string, language types.Language, cfg *config.Config) error
-func (p *Processor) processFileWithLineRanges(filename string, lineRanges []git.LineRange, cfg *config.Config) error
-```
-
-## jj commit
-
-```
-jj describe -m "refactor(processor): inject cfg into file-mutating methods"
-jj new
-```
-
-Result:
-```
-lyzxvysr e01678cb refactor(processor): inject cfg into file-mutating methods
-```

internal/processor/wholefile_test.go

@@ -65,6 +65,12 @@ func runWholeFileCase(t *testing.T, tc wholeFileCase) {
 
 	golden := src + ".golden"
 	if *update {
+		// Goldens are hand-verified expected values. Regenerating under CI would
+		// let the suite pass unconditionally while overwriting the checked-in
+		// goldens — the exact regression the golden strategy exists to catch.
+		if os.Getenv("CI") != "" {
+			t.Fatal("-update must not be used in CI: it overwrites goldens and makes assertions trivially pass")
+		}
 		if err := os.WriteFile(golden, got, 0644); err != nil {
 			t.Fatalf("update golden: %v", err)
 		}