fix: close release review findings

[ratovarius]

Summary

• treat inaccessible or dangling encrypted credential paths as hard authentication failures instead of falling back
• preserve the enclosing tab ID when resolving comment anchors with omitted range tab IDs
• add regression tests for both cases

Verification

• 95 library tests
• 757 CLI tests
• 22 integration tests
• 4 file-root tests
• Rust formatting and workspace Clippy

This PR addresses the latest review findings on release PR #20 and should merge into develop before the release is promoted to main.

[Copilot]

Copilot review overview

🟡 Changes recommended

Tab IDs are not propagated from tabProperties, and the required changeset is missing.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Read enclosing tab ID from tabProperties · New
• Add required changeset for user-visible fixes · New
• Test blocking fallback on metadata permission errors · New

What changed in this PR

Fixes credential fallback handling and Google Docs comment-anchor resolution.

Changes:

• Detects dangling/inaccessible encrypted credential paths.
• Propagates enclosing tab IDs to comment ranges.
• Adds regression tests for both areas.

File	Description
auth.rs	Hardens encrypted credential detection and adds a symlink test.
read.rs	Adds tab context during anchor collection.
read_tests.rs	Tests anchors lacking explicit tab IDs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ratovarius]

Addressed all three Copilot findings in commit 33ebe36:

• read comment anchors now derive enclosing tab IDs from tabProperties.tabId
• added a patch changeset for the user-visible fixes
• added deterministic auth coverage for metadata permission errors blocking credential fallback

Validation: 95 library tests, 758 CLI tests, 22 integration tests, 4 file-root tests, rustfmt, workspace Clippy, and repository hooks pass.