test(ensemble): page header dispose and upload path guard coverage

[cursor]

Description

Adds regression tests for two recently merged risk areas: PageState header lifecycle (storage-driven title bar height and collapsible header) and the multipart upload path traversal guard on UploadUtils.uploadFiles.

Related Issue

Cron-driven test coverage automation (no linked issue).

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Documentation update
• Refactoring (no functional changes)
• Tests only (no production code changes)

What Has Changed

• modules/ensemble/test/widget/page_header_lifecycle_test.dart: Widget test that mounts a Page whose header opts into listenTitleBarHeightStorage with titleBarHeight bound to ensemble.storage.*, plus an enabled collapsible header whose visible expression uses ensemble.storage.*. After pumping past the periodic timer intervals, the page is torn down and we assert no async exceptions (guards against timers or stream subscriptions firing after dispose; aligns with fix 2c45e427).
• modules/ensemble/test/upload_path_security_test.dart: expectLater on UploadUtils.uploadFiles with a File whose path contains .., asserting FormatException before any network work (extends bbb76c62 beyond the pure uploadPathContainsParentSegment helper).

Risky behavior now covered

1. Page header lifecycle: Periodic title-bar and collapsible-header polling timers plus ModelChangeEvent subscriptions must be cancelled when the Page is disposed; leaking them can call setState on defunct state or multiply listeners (the production fix addressed duplicate registration and missing timer cancellation).
2. Upload path traversal: Ensures the public uploadFiles API rejects unsafe paths, not only the string helper, so refactors cannot drop the guard at the call site.

How to Test

From modules/ensemble:

flutter test test/widget/page_header_lifecycle_test.dart
flutter test test/upload_path_security_test.dart

Note: The automation sandbox did not have the Flutter SDK on PATH; CI / local runs should execute the commands above.

Screenshots / Videos

N/A (tests only).

Checklist

• I have run flutter analyze and addressed any new warnings
• I have run flutter test and all tests pass (not run in agent environment — please verify in CI)
• I have tested my changes on the relevant platform(s)
• I have updated documentation if needed
• My changes do not introduce new warnings or errors (lints clean on edited files via IDE diagnostics)

Why these tests materially reduce regression risk

• The Page test exercises the full opt-in header wiring (YAML → SinglePageModel → PageState.initState → timers/subscriptions) and fails loudly if dispose cleanup regresses, which is a common source of flaky CI and user crashes after navigation.
• The upload test pins the security invariant at the API boundary used by file upload actions, so a future change cannot silently skip the guard while leaving the helper tested.