Summary

• Adds an end-to-end runtime --format jwks bundle test for scanner-safe metadata.
• Verifies RSA/ECDSA/Ed25519 JWKS artifacts are scanner-safe while HMAC/token runtime material remains counted as secret-bearing.
• Removes a no-panic-family test debt site in xtask user_path_smoke surfaced by the requested validation.

Files added/changed

• crates/uselesskey-cli/tests/cli.rs
• xtask/src/user_path_smoke.rs

Validation

• cargo test -p uselesskey-cli --test cli --all-features bundle_profile_runtime_jwks_marks_public_key_artifacts_scanner_safe
• cargo test -p uselesskey-cli --all-features
• cargo clippy -p uselesskey-cli --all-features --tests -- -D warnings
• cargo xtask no-blob
• cargo xtask user-path-smoke
• cargo test -p xtask user_path_smoke
• cargo xtask check-no-panic-family
• cargo +nightly xtask pr-lite
• cargo xtask pr
• git diff --check

Non-goals

• No new fixture family or contract pack.
• No scanner-evasion or provider-compatibility claim changes.
• No release machinery or badge changes.

What this enables next

• Closes the reviewer-identified JWKS integration coverage gap after the runtime scanner-safe metadata fix.
• Keeps adoption-smoke/no-panic validation green for the next queue item.