Fix unreachable_pub and unsafe_code warnings in test code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/crates/fabro-agent/src/lib.rs

@@ -59,4 +59,5 @@ pub use truncation::{
 pub use types::{AgentEvent, SessionEvent, SessionState, Turn};
 
 #[cfg(test)]
+#[allow(unreachable_pub)]
 pub(crate) mod test_support;

lib/crates/fabro-cli/src/commands/run/attach.rs

@@ -591,6 +591,7 @@ mod tests {
     }
 
     #[test]
+    #[allow(unsafe_code)]
     fn engine_child_guard_defuse_keeps_alive() {
         let child = std::process::Command::new("sleep")
             .arg("60")

lib/crates/fabro-store/src/keys.rs

@@ -120,7 +120,7 @@ pub(crate) fn parse_node_key(key: &str) -> Option<(String, u32, String)> {
 }
 
 #[cfg(test)]
-pub fn parse_node_asset_key(key: &str) -> Option<(String, u32, String)> {
+pub(crate) fn parse_node_asset_key(key: &str) -> Option<(String, u32, String)> {
     parse_visit_scoped_key(key, ARTIFACT_NODES_PREFIX)
 }
 

lib/crates/fabro-workflows/src/handler/llm/cli.rs

@@ -966,6 +966,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[allow(unsafe_code)]
     async fn ensure_cli_skips_install_when_present() {
         let sandbox: Arc<dyn Sandbox> = Arc::new(CliMockSandbox::new(vec![ok_result()]));
         let emitter = Arc::new(EventEmitter::new());
@@ -980,6 +981,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[allow(unsafe_code)]
     async fn ensure_cli_installs_when_missing() {
         // version check fails, combined install succeeds
         let sandbox: Arc<dyn Sandbox> = Arc::new(CliMockSandbox::new(vec![

lib/crates/fabro-workflows/src/node_handler.rs

@@ -150,7 +150,7 @@ mod tests {
     use crate::graph::WorkflowGraph;
 
     /// Minimal spike handler that always succeeds — proves the trait plumbing.
-    pub struct SpikeHandler;
+    pub(crate) struct SpikeHandler;
 
     #[async_trait]
     impl NodeHandler<WorkflowGraph> for SpikeHandler {