test(sdk): close test gaps — registry concurrency, Rust pagination + hooks

[5ran6]

Test gaps closed

Follow-up to the Staff-engineer review (PR #16): closes the registry TOCTOU + the bucket-3 Rust test gaps with proper regression tests.

🐛 Registry first-fetch TOCTOU — fixed in 3 SDKs

Rust, Go, and Python all had the same RLock → drop → Lock pattern in their token / pubkey caches. Under contention, N concurrent first-fetch callers would each see a cache miss before the first writer populated it — and each would issue a duplicate HTTP request. Now serialized:

SDK	Mechanism
Rust	tokio::sync::Mutex<()> on AggregatorRegistry::fetch_lock
Go	sync.Mutex on aggregatorRegistry.fetchMu
Python	threading.Lock on AggregatorRegistry._fetch_lock (was unsynchronized at all)

TypeScript and PHP are unaffected — both single-threaded by default.

🧪 Regression tests

Each language stands up an in-process counting HTTP fixture, fires 16 concurrent first-fetches, and asserts exactly 1 HTTP hit reaches the server. Without the serializer these tests would observe 16 hits.

• sdks/rust/src/registry.rs::tests::concurrent_first_fetches_share_one_request — uses tokio::net::TcpListener for a real TCP fixture so the reqwest transport is exercised end-to-end.
• sdks/go/sdk/registry_concurrency_test.go — covers token and pubkey paths; runs clean under go test -race.
• sdks/python/tests/test_registry_concurrency.py — uses stdlib http.server + concurrent.futures.ThreadPoolExecutor.

The fixtures inject a 50ms delay on the slow path so concurrent callers reliably overlap on the cache miss instead of finishing serially. Subsequent calls verify the cache is populated (no further hits).

🦀 Rust bucket-3 test gaps filled

The Staff review noted Rust shipped pagination + hooks in bucket 3 with only constructor/default-value coverage. New tests:

• list_all_orders_walks_pages — three-page counting fixture verifies the collector terminates after total is reached and yields the full ordered set across pages.
• request_hooks_fire_per_attempt — runs a 200 then a 401 against the fixture and verifies on_request / on_response / on_error fire in the right sequence with the real status code in HookContext.

Rust contract tests: 12 → 17. Total Rust tests: 17 → 20.

🔧 Crate-private widening

• HttpContext::new: fn new → pub(crate) fn new so the new registry concurrency test (inside the crate) can construct a minimal context without going through the public PaycrestClient. No external surface change.
• tokio features expanded to include net, io-util, sync so the TcpListener fixture compiles.

📊 Test counts after this PR

SDK	Before	After	Δ
TypeScript	35	35	—
Python	27	29	+2
Go	32	34	+2
Rust	17	20	+3
Laravel/PHP	29	29	—
Total	140	147	+7

✅ Verified

• ./scripts/tests/run_all_smoke.sh — all 5 SDKs green
• go test ./sdk/... -race — clean, no data race detected
• ./scripts/tests/parity/run_parity.sh — all 5 SDKs replay identical HTTP envelopes through the fixture server

https://claude.ai/code/session_01XqN2uu93AQVrD5KuhJvqoY