add blocked-string rewrite validation fixtures (#8)

## Summary
- add reusable sanitize/rewrite fixtures that seed blocked strings
across file contents, commit messages, refs, and paths
- add scan/assert helpers for full-surface detection and removal checks
- document fixture usage and focused test commands in README/developer
docs

## Test plan
- [x] `go test ./... -run 'RewriteValidation|BlockedStringCoverage'`
- [x] `go test ./...`

Made with [Cursor](https://cursor.com)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Adds new exported helpers that execute git commands and parse repo
history/refs, so edge cases and performance of scans could affect
downstream tests; changes are otherwise additive and well-covered by new
tests.
> 
> **Overview**
> Adds a new sanitize/rewrite validation fixture
(`CreateRewriteValidationFixture`) that seeds a repo with a configurable
blocked token across **file content, commit messages, refs (branch/tag),
and object paths**.
> 
> Introduces scan/validate/assert helpers (`ScanBlockedStringSurfaces*`,
`ValidateBlockedStringCoverage*`, `AssertBlockedStringCoverage*`) to
verify blocked-string detection coverage pre-rewrite and confirm
complete removal post-rewrite.
> 
> Updates `README.md`, `DEVELOPER_GUIDE.md`, and package docs with usage
examples and a focused test command, and adds
`sanitize_fixtures_test.go` to exercise fixture creation, invalid token
rejection, and a simulated history rewrite cleanup flow.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
dc8e18b. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated developer guide with sanitize/rewrite testing workflow
examples and targeted test commands
* Added sanitize/rewrite validation helpers to README with usage
guidance

* **New Features**
* Added test fixture creation helper for seeding blocked-strings across
Git surfaces (contents, history, refs, paths)
* Added blocked-string detection and assertion utilities for validation
testing

* **Tests**
* Added comprehensive test coverage for sanitize/rewrite validation
scenarios

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Ben Schellenberger <TBRX103@users.noreply.github.com>
Co-authored-by: Ben Schellenberger <bschellenberger2600@users.noreply.github.com>

Author: 3 people

DEVELOPER_GUIDE.md

@@ -31,9 +31,11 @@ go test ./...
 ## Project structure
 
 - `fixtures.go`: base repo creation and command helpers.
+- `sanitize_fixtures.go`: reusable sanitize/rewrite fixtures plus blocked-string scan/assert helpers.
 - `scenarios.go`: fluent scenario builder and predefined multi-repo scenarios.
 - `snapshots.go`: snapshot/restore utilities for expensive test setup reuse.
 - `fixtures_test.go`: external package tests (`testutil_test`) that validate public API usage.
+- `sanitize_fixtures_test.go`: coverage tests for blocked-string detection/removal across content/history/refs/paths.
 - `usb_fixtures.go` / `usb_fixtures_test.go`: USB volume root and `.git-fire` config helpers for backup-mode style tests.
 - `scenarios_test.go`: package-internal tests for scenario/snapshot behavior.
 
@@ -74,6 +76,18 @@ Common usage split:
 - `CreateTestRepo`: fast setup for single-repo state.
 - `NewScenario`: multi-repo topologies and fluent setup.
 - `SnapshotRepo`/`RestoreSnapshot`: performance optimization for repeated expensive setups.
+- `CreateRewriteValidationFixture` + blocked-string assertions: sanitize/rewrite validation against file contents, commit messages, refs, and paths.
+
+Sanitize/rewrite focused validation loop:
+
+```bash
+# Run only sanitize/rewrite fixture and assertion tests.
+go test ./... -run 'RewriteValidation|BlockedStringCoverage'
+
+# Full required local gate.
+go vet ./...
+go test ./...
+```
 
 ## Adding new helpers
 

README.md

@@ -30,6 +30,7 @@ go get github.com/git-fire/git-testkit
 - Repository fixtures (`CreateTestRepo`, `CreateBareRemote`, `RunGitCmd`)
 - Scenario builders for common multi-repo states (`NewScenario`, conflict/worktree helpers)
 - Snapshot helpers for capturing and restoring repository state in tests
+- Sanitize/rewrite validation helpers for blocked-string coverage across content/history/refs/paths
 
 ## API overview
 
@@ -38,6 +39,8 @@ go get github.com/git-fire/git-testkit
 - `NewScenario(t)` returns a fluent builder for multi-repo test topologies.
 - `SnapshotRepo(t, path)` and `RestoreSnapshot(t, snap)` speed up repeated fixture setup.
 - `IsDirty`, `GetCurrentSHA`, `GetBranches`, `GetRemotes` provide common assertions/helpers.
+- `CreateRewriteValidationFixture(t, opts)` seeds blocked strings across file contents, commit messages, refs, and paths.
+- `AssertBlockedStringCoverageDetected` and `AssertBlockedStringCoverageRemoved` validate sanitize/rewrite coverage before/after rewriting.
 
 ## Quickstart for using in tests
 
@@ -113,6 +116,33 @@ func TestUsingSnapshot(t *testing.T) {
 }
 ```
 
+### Validate sanitize/rewrite coverage
+
+```go
+func TestRewriteRemovesBlockedString(t *testing.T) {
+	fixture := testutil.CreateRewriteValidationFixture(t, testutil.RewriteValidationFixtureOptions{
+		Name:          "rewrite-fixture",
+		BlockedString: "blockedtoken",
+	})
+
+	// Confirm fixture coverage before running your rewrite logic.
+	testutil.AssertBlockedStringCoverageDetected(t, fixture.RepoPath, fixture.BlockedString)
+
+	// Run your sanitizer/rewrite command against fixture.RepoPath here.
+	// Example:
+	// testutil.RunGitCmd(t, fixture.RepoPath, "filter-branch", ...)
+
+	// Validate the blocked string is removed from all tracked surfaces.
+	testutil.AssertBlockedStringCoverageRemoved(t, fixture.RepoPath, fixture.BlockedString)
+}
+```
+
+Run just sanitize/rewrite-focused tests:
+
+```bash
+go test ./... -run 'RewriteValidation|BlockedStringCoverage'
+```
+
 ## Notes
 
 - Snapshots are intended for deterministic test fixtures and only restore regular files/directories.

doc.go

@@ -11,6 +11,8 @@
 //     remote, diverged clones, worktrees, conflict states).
 //   - [SnapshotRepo] / [RestoreSnapshot] for capturing expensive fixture state
 //     once and restoring it cheaply across subtests.
+//   - [CreateRewriteValidationFixture] plus blocked-string assertions for
+//     sanitize/rewrite validation across content, commit history, refs, and paths.
 //
 // All helpers integrate with Go's testing.T: repositories are created inside
 // t.TempDir() and cleaned up automatically, and setup failures call t.Fatalf