Make authenticator opacity test independent of source line endings #711

The secret_authenticator_api_remains_opaque test in src/state_auth.rs splits include_str!("state_auth.rs") at the exact LF marker "\n#[cfg(test)]\nmod tests". In a CRLF checkout that marker is absent, so production includes the test module. The test then finds its own forbidden API examples and fails, even though the production authenticator has not changed.

Reproduction: with CRLF bytes in src/state_auth.rs, the LF-only marker is absent, the split has one part, and that part contains both secret_authenticator_api_remains_opaque and impl Debug for RepositoryAuthenticator. This was observed in a Windows checkout projected into WSL. The interrupted all-target run reported this test as FAILED, but did not retain its assertion body; the source-level failure mechanism is deterministic.

Acceptance:

• Isolate the production section for LF and CRLF source bytes without weakening the forbidden-surface checks.
• Cover both line endings with a focused regression.
• Keep the authenticator API and production behavior unchanged.