[0x73746F66]

Closes #289

What

Stdlib table tests, matching each package's existing style:

• internal/imagesrc/imagesrc_helpers_test.go: metaFor (tag ref sets Registry/Repository/Tag, digest ref sets ManifestListDigest), parsePlatform (empty -> linux/host arch, linux/arm64, variant, malformed -> error naming the platform), explainRegistryError (UNAUTHORIZED/DENIED/401 -> docker login <registry>, schema 1, plain fetch <ref>), registryOf (valid and invalid refs), Image.Close on nil, without cleanup, and with cleanup once.
• internal/apispecs/summary_test.go: Discover skips a zero-byte spec, a sparse file over maxSpecBytes and an unparsable openapi.yaml without stopping the walk, and returns path order; Summary singular/plural operation counts; plural/itoa.
• internal/managedfile/mode_dryrun_test.go: File.Mode (merge wins over structured), ownsContent (host alone, marker alone, neither, both empty), RemoveFile dry runs for structured-with-backup, structured-ours, structured-not-ours, merge strip, merge nothing-to-strip, block-only and block-among-user-content: outcome flags reported, file and backup untouched.

Bug fixed

apispecs.Summary printed , 2 losss for conversion losses: plural appended a bare s to loss. Words ending in s now take es (2 losses). Nothing else in the repository depends on the old spelling.

Verified

go test -cover passes: imagesrc 63.0%, apispecs 92.1%, managedfile 66.2% (from 55.8%, 49.2%, 59.8%). gofmt clean.

[github-actions]

Vulnetix config plan

Manager gitops:vulnetix/cli, prune off, plan hash a8bd984f1753c68b180298051dd9e2524ab644d2ebe9e4c7c811ff4126753b5f

	Object	Action	Changes
~	QualityGate/default	update (adopt)	severity: null -> "high"

0 to create, 1 to update, 0 to delete, 0 unchanged

[0x73746F66]

Reuse review: plural in internal/apispecs is fixed in place ("loss" -> "losses") rather than a second helper added; the tests use the real Summary, managedfile dry-run and imagesrc helpers with t.TempDir(). No changes needed.

[0x73746F66]

Reuse review: no reinvented Vulnetix patterns found. The change stays inside the package it covers, uses stdlib/testify helpers already used by the repo's tests, and adds no new client, auth, config-schema or shared-package duplicate (checked internal/testutils and sibling repos). Rebased onto current main locally: go vet and go test pass for every touched package. The earlier red checks (CodeQL Analyze, Install a release with verified provenance, Lockfile) were GitHub API rate-limit failures, not code failures; this will be re-run on a rebased head before merge.