Adds comprehensive tests for streaming commands and configuration:

- Listen: --print-secret to verify webhook connection, event filtering
- Logs tail: startup verification with timeout, filter support
- Config: set API key via config, multi-profile support
- Login: help verification (interactive login requires browser)

Build improvements:
- Use production-like build (CGO_ENABLED=0, -ldflags="-s -w", go generate)
- Add build-canary Makefile target

Fixes:
- Add --confirm flag for delete operations (skip interactive prompt)
- Create config directory structure in temp dirs for config tests

Total: 19 offline tests, 13 API tests (32 total)

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Committed-By-Agent: claude

Adds background process support to the test runner and three new tests:
- TestAPIListenForwardTo: Verifies webhooks are forwarded to local server
  with correct payload, headers (Stripe-Signature), and event structure
- TestAPIListenOutputFormat: Verifies listen shows events in JSON format
- TestAPILogsTailCapture: Verifies logs tail captures API requests

The runner enhancement includes RunBackground(), WaitForOutput(),
GetOutput(), and Stop() methods for managing long-running CLI processes.

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Committed-By-Agent: claude

Split the monolithic runner_test.go into logical files:
- helpers_test.go: shared test utilities (getRunner, requireAPIKey)
- basic_test.go: version, help, completion, status, error handling
- api_test.go: API resource tests (balance, customers, products, events)
- listen_test.go: webhook listener tests
- logs_test.go: logs tail streaming tests
- config_test.go: config and authentication tests
- login_test.go: login command tests

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Committed-By-Agent: claude

Remove pull_request trigger from canary-test.yml (unit tests cover PRs).
Add workflow_call trigger so the release workflow can invoke canary tests
as a prerequisite — all three OS build jobs now depend on canary-tests
passing before GoReleaser runs. Update README to reflect new triggers.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
Committed-By-Agent: claude

Rename printf-like function logSanitized → logSanitizedf to satisfy
goprintffuncname linter. Fix whitespace alignment in sanitize.go for
gofmt compliance.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Committed-By-Agent: claude

…options, add login test

- Make STRIPE_TEST_API_KEY required for workflow_call (callers must pass it)
- Tighten API test if-condition to respect run_api_tests toggle per event type
- Add RunnerOption functional options to NewRunner for idiomatic Go construction
- Migrate test files to pass env at construction via getRunner(t, WithEnv(...))
- Add TestAPIGlobalAPIKeyFlag to verify non-interactive auth via --api-key flag

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Committed-By-Agent: claude

The secrets context can't be used in step-level if expressions in
GitHub Actions. Add a preceding step that checks secret availability
via an environment variable and exposes it as a step output.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Committed-By-Agent: claude

Enables testing the new workflow on a PR before merging to master.
Remove this trigger before merging.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Committed-By-Agent: claude

PR events don't have access to repo secrets, so API tests skip
gracefully while offline tests still run. Safe to keep enabled.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Committed-By-Agent: claude

Bump job timeout from 20 to 25 minutes and WaitForOutput timeouts from
30s to 60s for listen and logs tail tests. Webhook endpoint initialization
and API connections can take longer on slow runners.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
Committed-By-Agent: claude