[TD-13] `pub fn test_config()` (with `/tmp/test-worker.key`) lives in non-test module

[intendednull]

Audit finding from #300 (commit 679f9fe)

Severity: low
Category: tech debt / API surface
File: crates/worker/src/config.rs:18-28
Obvious fix: yes

Description

WorkerConfig::test_config() is a pub constructor in the production module that returns a config with /tmp/test-worker.key. It is not gated by #[cfg(test)], so it is part of the crate's public API and any binary linking willow-worker could call it. The /tmp/test-worker.key path itself is a fixture leak (originally tracked as part of TD-06's hardcoded paths; consolidated here since it is a struct-field default rather than a clap default_value).

Impact / Threat

Maintenance, bug-risk — public test fixtures should not be reachable from release builds.

Suggested fix

Move the function to a #[cfg(any(test, feature = "test-utils"))] module (matching the pattern already used in willow-network for mem.rs).

Verify

rg "test_config|/tmp/test-worker.key" crates/worker/src/config.rs