feat: T1016 dns_config probe + server-side drift detection + Crucible DNS DRIFT badge

server/internal/sys/firewall_test.go

@@ -0,0 +1,32 @@
+package sys
+
+import (
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestEnsureInboundTCPPortInvalidPort(t *testing.T) {
+	err := EnsureInboundTCPPort(0, "test")
+	if err == nil {
+		t.Fatal("expected error for port 0")
+	}
+	if runtime.GOOS == "windows" {
+		if !strings.Contains(err.Error(), "invalid port") {
+			t.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+func TestEnsureInboundTCPPortNonWindows(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("stub-only test for non-Windows builds")
+	}
+	err := EnsureInboundTCPPort(8080, "test")
+	if err == nil {
+		t.Fatal("expected error on non-Windows")
+	}
+	if !strings.Contains(err.Error(), "only supported on Windows") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}