fix: address review findings from rounds 2843-2846

- Remove redundant timer.Stop() after timer fires (Sonnet #1, GPT #2)
- Remove unused TotalCount field from checkRunsResponse (Sonnet #2)
- Improve escapePath doc comment to explain deliberate silent stripping (Sonnet #3)
- Fix ListContents to handle both array (directory) and object (single file)
  responses from GitHub Contents API (GPT #3)
- Add HTTPS enforcement: refuse to send credentials over non-HTTPS URLs
  unless AllowInsecureHTTP() option is passed (Security #1)
- Replace constant-value test with actual behavior test for response
  body limiting (Sonnet #6)
- Run gofmt for consistent formatting (Sonnet #4)
- Add tests for HTTPS enforcement and ListContents single-file handling

github/files.go

@@ -19,6 +19,9 @@ func (c *Client) GetFileContent(ctx context.Context, owner, repo, path, ref stri
 
 // ListContents lists files and directories at a given path in a repo.
 // Returns the directory listing from the GitHub contents API.
+// If the path points to a single file (not a directory), the API returns
+// a JSON object instead of an array; this is handled by returning a
+// single-element slice.
 func (c *Client) ListContents(ctx context.Context, owner, repo, path string) ([]vcs.ContentEntry, error) {
 	reqURL := fmt.Sprintf("%s/repos/%s/%s/contents/%s",
 		c.baseURL, url.PathEscape(owner), url.PathEscape(repo), escapePath(path))
@@ -26,14 +29,24 @@ func (c *Client) ListContents(ctx context.Context, owner, repo, path string) ([]
 	if err != nil {
 		return nil, fmt.Errorf("list contents %s: %w", path, err)
 	}
-	var entries []struct {
+
+	type entry struct {
 		Name string `json:"name"`
 		Path string `json:"path"`
 		Type string `json:"type"`
 	}
+
+	// The GitHub contents API returns an array for directories and an object
+	// for single files. Try array first (common case), then fall back to object.
+	var entries []entry
 	if err := json.Unmarshal(body, &entries); err != nil {
-		return nil, fmt.Errorf("parse contents JSON: %w", err)
+		var single entry
+		if err2 := json.Unmarshal(body, &single); err2 != nil {
+			return nil, fmt.Errorf("parse contents JSON: %w", err)
+		}
+		entries = []entry{single}
 	}
+
 	result := make([]vcs.ContentEntry, len(entries))
 	for i, e := range entries {
 		result[i] = vcs.ContentEntry{
@@ -47,7 +60,11 @@ func (c *Client) ListContents(ctx context.Context, owner, repo, path string) ([]
 
 // escapePath escapes each segment of a relative file path for use in URLs.
 // Slashes are preserved as path separators; other special characters are escaped.
-// Dot-segments ("." and "..") are removed to prevent path traversal.
+// Dot-segments ("." and "..") are silently removed to prevent path traversal.
+// This is intentional: callers may receive a different path than requested without
+// error. The function is package-private, and all callers (GetFileContentAtRef,
+// ListContents) already handle missing-file errors from the API if the cleaned
+// path doesn't match what the caller intended.
 func escapePath(p string) string {
 	parts := strings.Split(p, "/")
 	var clean []string