fix: address review findings from reviews #2955 and #2958

- Convert handleResponse to package-level function (unused receiver) [#17955]
- Add clarifying comment for nil resp on transport error [#17956]
- Use consistent %w wrapping in dual-unmarshal error path [#17957]
- Add SafeError() method to APIError for safe logging [#17964]
- Enforce safe CheckRedirect policy in SetHTTPClient [#17965]
- Add tests for SafeError and SetHTTPClient enforcement

github/client_test.go

@@ -554,3 +554,46 @@ func TestSetHTTPClient_NilRestoresDefault(t *testing.T) {
 		t.Fatal("expected CheckRedirect policy after SetHTTPClient(nil)")
 	}
 }
+
+func TestSetHTTPClient_NilCheckRedirectEnforcesDefault(t *testing.T) {
+	c := NewClient("token", "https://api.github.com")
+	// Provide a client with nil CheckRedirect — should get default policy enforced.
+	hc := &http.Client{Timeout: 5 * time.Second}
+	c.SetHTTPClient(hc)
+	if c.httpClient.CheckRedirect == nil {
+		t.Fatal("expected CheckRedirect to be enforced when caller provides nil")
+	}
+	if c.httpClient.Timeout != 5*time.Second {
+		t.Errorf("expected caller's timeout preserved, got %v", c.httpClient.Timeout)
+	}
+}
+
+func TestSetHTTPClient_PreservesCustomCheckRedirect(t *testing.T) {
+	c := NewClient("token", "https://api.github.com")
+	called := false
+	hc := &http.Client{
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			called = true
+			return nil
+		},
+	}
+	c.SetHTTPClient(hc)
+	// Invoke the redirect to verify original is preserved
+	_ = c.httpClient.CheckRedirect(nil, []*http.Request{{}})
+	if !called {
+		t.Fatal("expected custom CheckRedirect to be preserved")
+	}
+}
+
+func TestAPIError_SafeError(t *testing.T) {
+	e := &APIError{StatusCode: 403, Body: "some sensitive body content"}
+	got := e.SafeError()
+	if got != "HTTP 403" {
+		t.Errorf("SafeError() = %q, want %q", got, "HTTP 403")
+	}
+	// Ensure Error() still includes body
+	full := e.Error()
+	if full != "HTTP 403: some sensitive body content" {
+		t.Errorf("Error() = %q, unexpected", full)
+	}
+}