Test coverage improvements

[dguido]

Summary

Consolidation of actionable test improvement ideas. These are opportunities to improve test coverage without changing core functionality.

Test Coverage Gaps

Cloud Provider Testing

• Mock cloud provider APIs to test deployment logic without real accounts
• Validate provider-specific config generation (regions, instance types, etc.)

User Management

• Test user management scripts in isolation (./algo update-users --dry-run)
• Test adding/removing users without full deployment

Upgrade & Migration

• Upgrade path testing (old configs → new configs)
• Test config migration between Algo versions

Scale Testing

• Performance testing for large user counts (100+ users)
• Measure config generation time at scale

CI/Workflow Improvements

From zizmor audit:

• Add persist-credentials: false to checkout actions in claude-code-review.yml and claude.yml
• Pin action references to commit SHAs instead of version tags (e.g., @v1 → @abc123...)

Notes

These are "nice to have" improvements, not urgent fixes. Pick items based on where bugs have actually occurred.

Related: #14912 (E2E tests - implemented)