Add record/replay fixture harness for end-to-end CLI tests

[alexkroman]

What

Captures real AssemblyAI API responses once and replays CLI commands through them offline, so the transcribe / transcripts / llm / account command families are exercised end-to-end (command + parsing + rendering) without touching the network.

Harness

• scripts/record_fixtures.py — a manual recorder (deliberately outside the gate; it hits the network). Drives the same client.* / llm.* / ams.* functions the CLI uses, scrubs every credential on the way out, and writes tests/fixtures/api/*.json. Refresh with:

  ASSEMBLYAI_API_KEY=… uv run python scripts/record_fixtures.py

  (The API key comes from the env; the AMS session JWT from the keyring of whoever ran aai login. Neither is ever written to a fixture.)
• tests/replay_fixtures.py — rebuilds the boundary objects from recorded JSON: a real aai.Transcript via from_response, and an OpenAI ChatCompletion via model_construct (which mirrors the SDK's own lenient wire parsing — the gateway returns Anthropic-flavored fields like finish_reason: "end_turn" that strict validation rejects).
• tests/test_replay_e2e.py — 7 replay tests, one per command family, fully offline (pytest-socket untouched).
• tests/fixtures/api/ — 7 scrubbed snapshots: API key / JWT redacted, email → user@example.com, account_id → 12345, private cdn.assemblyai.com/upload/<hash> URLs redacted. gitleaks-clean.

Drive-by fixes (two pre-existing cross-platform gate failures)

Both pass on Linux CI but fail the dev gate on macOS:

• share.py — mypy --warn-unreachable targets one platform at a time, so the if sys.platform == "darwin": return … made the other return provably dead (line 33 on macOS, the first return on Linux). Rewritten as a ternary expression so neither branch is a statement mypy can flag.
• test_source_validation.py — a long tmp path let Rich wrap mid-word (py test), defeating the test's " ".join(split()) unwrap. Now compares with all whitespace removed, matching the existing pattern in test_share.py.

Testing

./scripts/check.sh → All checks passed (1391 tests, 100% patch coverage, mutation gate clean, build + twine OK).

🤖 Generated with Claude Code

[aikido-pr-checks]

The nested function scrub performs unbounded recursion over input structures (dict/list) without a depth limit; add an explicit max-depth parameter or convert to an iterative traversal to prevent stack overflows on deeply nested inputs.

Details

✨ AI Reasoning
​The PR adds a recursive scrubber function used to traverse arbitrary JSON-like objects. It directly calls itself for dict values and list items without any explicit depth limiting or loop-based alternative. Recursive traversal of untrusted or very deep structures can cause unbounded call depth and stack overflow. The change introduced this recursion rather than modifying pre-existing recursive code.

🔧 How do I fix it?
Add depth limiting via counter parameters that are checked and enforced, or replace with iterative approaches using explicit loops or stack data structures. For graphs, combine depth limiting with visited set tracking.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}