test(14.3-04): cover every summer new branch, key and CLI path

- name rule, existing targets, framework resolution order, inside-checkout refusal
- cleanup on failure, key validation, .env 0600, AGENTS.md symlink
- first commit identity, configured identity, missing git, --no-git, --no-plugin build
- plugin:add relative go.work, plain make:plugin routes, GenerateAppKey, summer new via the CLI

modules/lagoon/keygen_test.go

@@ -39,7 +39,8 @@ func TestEncryptedKeyGeneratePrints32ByteBase64(t *testing.T) {
 	}
 }
 
-func TestGenerateAppKeyIs32ByteBase64(t *testing.T) {
+// TestGenerateAppKey: 44 characters, 32 decoded bytes, distinct values.
+func TestGenerateAppKey(t *testing.T) {
 	a, err := GenerateAppKey()
 	if err != nil {
 		t.Fatal(err)