test: add coverage for capabilities, rate-limiting, and upgrade modules

[Copilot]

Several exported functions had zero test coverage: generatePodCapabilitiesPath, KNOWN_CAPABILITIES, loadRatePool, and the entire upgrade semver/pluggable API surface.

Capabilities (test/capabilities.test.ts, +10 tests)

• generatePodCapabilitiesPath — path generation for pod-specific manifests
• KNOWN_CAPABILITIES — validates exported constant (8 identifiers)
• loadCapabilities edge cases — malformed JSON, undefined teamRoot, no podId stamping in agent-per-node mode

Rate-limiting (test/rate-limiting.test.ts, +4 tests)

• loadRatePool — valid/malformed JSON, missing file, undefined teamRoot

Upgrade semver & pluggable API (test/cli/upgrade-semver.test.ts, 26 tests)

• parseVersion, compareVersions, isNewer — pure semver logic
• checkForUpdate, performUpgrade, upgradeSDK — uses the existing pluggable setVersionFetcher/setPackageJsonReader/setPackageJsonWriter hooks for isolated testing without mocks

// Example: upgrade module tests use the pluggable API directly
setVersionFetcher(async () => '2.0.0');
setPackageJsonReader(async () => ({
  version: '1.0.0',
  dependencies: { '@bradygaster/squad': '^1.0.0' },
}));
const result = await upgradeSDK('/fake/project');
expect(result.toVersion).toBe('2.0.0');

Full suite: 6322 passed, 2 pre-existing env failures (Playwright/Astro not installed).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• aka.ms
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli boards work-item type list --org REDACTED --project no-proj --output json postbuild (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli boards work-item type list --org REDACTED --project nonexistent-project --output json ite(sys.executable.encode('utf-8')); dev /usr/local/bin/bash (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli boards work-item type list --org REDACTED --project no-proj --output json --noprofile (dns block)
• app.aladdin.microsoft.com
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli boards work-item type list --org REDACTED --project nonexistent-project --output json ite(sys.executable.encode('utf-8')); dev /usr/local/bin/bash (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli boards work-item type list --org REDACTED --project no-proj --output json postbuild (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli boards work-item type list --org REDACTED --project no-proj --output json --noprofile (dns block)
• azcliprod.blob.core.windows.net
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli boards work-item type list --org REDACTED --project nonexistent-project --output json ite(sys.executable.encode('utf-8')); dev /usr/local/bin/bash (dns block)
• https://api.github.com/copilot_internal/user
  • Triggering command: /home/REDACTED/work/squad/squad/node_modules/@github/copilot-linux-x64/copilot /home/REDACTED/work/squad/squad/node_modules/@github/copilot-linux-x64/copilot --acp k/_temp/ghcca-node/node/bin/git /usr/sbin/iptables js -t raw /home/REDACTED/work/node_modules/.bin/git PREROUTING -p tcp git remo�� get-url origin ndor/bin/git -i docker0 -j git (http block)
  • Triggering command: /home/REDACTED/work/squad/squad/node_modules/@github/copilot-linux-x64/copilot /home/REDACTED/work/squad/squad/node_modules/@github/copilot-linux-x64/copilot --acp --stdio git remo�� get-url origin /usr/bin/docker --show-toplevel git /usr/bin/git docker --ve�� k/squad/squad/no--show-toplevel git de_modules/.bin/git o | grep "core igit git git grep (http block)
  • Triggering command: /home/REDACTED/work/squad/squad/node_modules/@github/copilot-linux-x64/copilot /home/REDACTED/work/squad/squad/node_modules/@github/copilot-linux-x64/copilot --acp ode-gyp-bin/git git diff�� est-kbAJ2j --name-only /home/REDACTED/.dotnet/tools/git DASHBOARD__FRONTgit -e it git diff�� origin/dev...HEAD --name-only git get-url origin 1/x64/lib/node_m49e39fb90126f91201d2c51de94feca3e88d6851 git (http block)
• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user -q .login -state a091010655ee6a57ad3c07f9 1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/git --detach --name-only -x64/copilot git upda�� refs/heads/squad-state 0ae6172dbe06cc875f68d3a7dcbadb845878cf1b ules/.bin/git cat /proc/cpuinfuniq git /bin/sh git (http block)
  • Triggering command: /usr/bin/gh gh api user -q .login name "Test" 13441446d4ddafc17a44cad28b034cd29017d0a5 /opt/hostedtoolcache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/nnode refs/heads/nonexgrep 3f4a91de /usr/bin/uniq git log --format=%T -1 e_modules/.bin/git k/_temp/ghcca-nouniq git ndor/bin/git /bin/sh (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)