Fix unused imports compile error in Rust guard labels/mod.rs (#5089)

The `docker` CI job was failing during the WASM guard build because
`has_demotion_label` and `has_promotion_label` were re-exported
unconditionally in `labels/mod.rs`, but are only used in test code. With
`-D warnings`, Rust treats this as a compile error.

## Change

Added `#[cfg(test)]` to the re-export, matching the existing pattern for
`has_approval_label` and `secret_label`:

```rust
// Before
pub use helpers::{has_demotion_label, has_promotion_label};

// After
#[cfg(test)]
pub use helpers::{has_demotion_label, has_promotion_label};
```

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more
addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by
firewall rules:
>
> - `example.com`
> - Triggering command: `/tmp/go-build1708705991/b513/launcher.test
/tmp/go-build1708705991/b513/launcher.test
-test.testlogfile=/tmp/go-build1708705991/b513/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -goversion go1.25.9 -c=4
-nolocalimports -importcfg /tmp/go-build1708705991/b504/importcfg -pack
/tmp/go-build1708705991/b504/_testmain.go o_.o�� 64/src/net -trimpath
x_amd64/vet 617502/b172/
google.golang.or-test.testlogfile=/tmp/go-build1708705991/b498/testlog.txt
-lang=go1.24 x_amd64/vet` (dns block)
> - `invalid-host-that-does-not-exist-12345.com`
> - Triggering command: `/tmp/go-build1708705991/b495/config.test
/tmp/go-build1708705991/b495/config.test
-test.testlogfile=/tmp/go-build1708705991/b495/testlog.txt
-test.paniconexit0 -test.timeout=10m0s
/tmp/go-build1708705991/b393/vet.cfg aHyH/ZRyj9BryPL3itfTYaHyH
k/gh-aw-mcpg/gh-aw-mcpg/internal/guard/guard.go x_amd64/vet 617502/b172/
net/http/interna-unsafeptr=false -lang=go1.25 x_amd64/vet o_.o��
ache/go/1.25.9/x64/src/runtime/cgo -fPIC x_amd64/vet ut-2187906326.c
-Wl,--no-gc-sect-atomic -fmessage-length-bool x_amd64/vet` (dns block)
> - `nonexistent.local`
> - Triggering command: `/tmp/go-build1708705991/b513/launcher.test
/tmp/go-build1708705991/b513/launcher.test
-test.testlogfile=/tmp/go-build1708705991/b513/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -goversion go1.25.9 -c=4
-nolocalimports -importcfg /tmp/go-build1708705991/b504/importcfg -pack
/tmp/go-build1708705991/b504/_testmain.go o_.o�� 64/src/net -trimpath
x_amd64/vet 617502/b172/
google.golang.or-test.testlogfile=/tmp/go-build1708705991/b498/testlog.txt
-lang=go1.24 x_amd64/vet` (dns block)
> - `slow.example.com`
> - Triggering command: `/tmp/go-build1708705991/b513/launcher.test
/tmp/go-build1708705991/b513/launcher.test
-test.testlogfile=/tmp/go-build1708705991/b513/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -goversion go1.25.9 -c=4
-nolocalimports -importcfg /tmp/go-build1708705991/b504/importcfg -pack
/tmp/go-build1708705991/b504/_testmain.go o_.o�� 64/src/net -trimpath
x_amd64/vet 617502/b172/
google.golang.or-test.testlogfile=/tmp/go-build1708705991/b498/testlog.txt
-lang=go1.24 x_amd64/vet` (dns block)
> - `this-host-does-not-exist-12345.com`
> - Triggering command: `/tmp/go-build1708705991/b522/mcp.test
/tmp/go-build1708705991/b522/mcp.test
-test.testlogfile=/tmp/go-build1708705991/b522/testlog.txt
-test.paniconexit0 -test.timeout=10m0s` (dns block)
>
> If you need me to access, download, or install something from one of
these locations, you can either:
>
> - Configure [Actions setup
steps](https://gh.io/copilot/actions-setup-steps) to set up my
environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this
repository's [Copilot coding agent
settings](https://github.com/github/gh-aw-mcpg/settings/copilot/coding_agent)
(admins only)
>
> </details>

Author: lpcox

guards/github-guard/rust-guard/src/labels/mod.rs

@@ -50,6 +50,7 @@ pub use helpers::{
 };
 #[cfg(test)]
 pub use helpers::has_approval_label;
+#[cfg(test)]
 pub use helpers::{has_demotion_label, has_promotion_label};
 #[cfg(test)]
 pub use helpers::secret_label;

internal/server/circuit_breaker.go

@@ -226,7 +226,6 @@ func (cb *circuitBreaker) State() circuitBreakerState {
 	return cb.state
 }
 
-
 // buildCircuitBreakers creates per-backend circuit breakers from the configuration.
 func buildCircuitBreakers(cfg *config.Config) map[string]*circuitBreaker {
 	cbs := make(map[string]*circuitBreaker)

internal/server/circuit_breaker_test.go

@@ -443,7 +443,6 @@ func TestCircuitBreakerState_String(t *testing.T) {
 	}
 }
 
-
 // TestIsRateLimitText_Direct directly verifies isRateLimitText with each pattern and edge cases.
 func TestIsRateLimitText_Direct(t *testing.T) {
 	t.Parallel()

internal/strutil/format_duration_test.go

@@ -166,16 +166,16 @@ func TestFormatDuration(t *testing.T) {
 }
 
 func TestFormatResetAt(t *testing.T) {
-t.Run("zero time returns unknown", func(t *testing.T) {
-result := FormatResetAt(time.Time{})
-assert.Equal(t, "unknown", result)
-})
+	t.Run("zero time returns unknown", func(t *testing.T) {
+		result := FormatResetAt(time.Time{})
+		assert.Equal(t, "unknown", result)
+	})
 
-t.Run("non-zero time includes RFC3339 timestamp and relative countdown", func(t *testing.T) {
-// Use a fixed future time so the test is deterministic.
-future := time.Date(2030, 1, 1, 12, 0, 0, 0, time.UTC)
-result := FormatResetAt(future)
-assert.Contains(t, result, "2030-01-01T12:00:00Z")
-assert.Contains(t, result, " (in ")
-})
+	t.Run("non-zero time includes RFC3339 timestamp and relative countdown", func(t *testing.T) {
+		// Use a fixed future time so the test is deterministic.
+		future := time.Date(2030, 1, 1, 12, 0, 0, 0, time.UTC)
+		result := FormatResetAt(future)
+		assert.Contains(t, result, "2030-01-01T12:00:00Z")
+		assert.Contains(t, result, " (in ")
+	})
 }