test: replace assert.Error with require.Error across test files

Follows same pattern as da3479c. require.Error halts test immediately
on failure, preventing nil dereference in subsequent assert.Contains calls.

cmd/firewall/allow_test.go

@@ -242,6 +242,6 @@ func TestEmitAllowRevoke_FetchFailurePropagates(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitAllowRevoke(context.Background(), inner, parent, local, fr, false)
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "coold token")
 }

cmd/firewall/resolve_test.go

@@ -59,12 +59,12 @@ func TestResolveEndpoint_UnknownRawIP_Synthetic(t *testing.T) {
 
 func TestResolveEndpoint_NotFound(t *testing.T) {
 	_, err := resolveEndpoint("nobody", cs())
-	assert.Error(t, err)
+	require.Error(t, err)
 }
 
 func TestResolveEndpoint_Empty(t *testing.T) {
 	_, err := resolveEndpoint("", cs())
-	assert.Error(t, err)
+	require.Error(t, err)
 }
 
 func TestFindHostForIP(t *testing.T) {

cmd/init/plan_test.go

@@ -15,7 +15,7 @@ func TestValidatePlanFlags(t *testing.T) {
 		err := validatePlanFlags(&InitFlags{
 			SSHMeshFlags: common.SSHMeshFlags{SSHKey: "/path/to/key"},
 		})
-		assert.Error(t, err)
+		require.Error(t, err)
 		assert.Contains(t, err.Error(), "--servers")
 	})
 
@@ -23,7 +23,7 @@ func TestValidatePlanFlags(t *testing.T) {
 		err := validatePlanFlags(&InitFlags{
 			SSHMeshFlags: common.SSHMeshFlags{Servers: []string{"1.1.1.1"}},
 		})
-		assert.Error(t, err)
+		require.Error(t, err)
 		assert.Contains(t, err.Error(), "--ssh-key")
 	})
 
@@ -50,7 +50,7 @@ func TestValidatePlanFlags(t *testing.T) {
 				Namespaces: []string{"Not Valid"},
 			},
 		})
-		assert.Error(t, err)
+		require.Error(t, err)
 		assert.Contains(t, err.Error(), "invalid namespace")
 	})
 }

internal/firewall/coold_client_test.go

@@ -109,7 +109,7 @@ func TestCooldApply_OmitsProtoWhenEmpty(t *testing.T) {
 func TestCooldRevoke_RejectsEmptyID(t *testing.T) {
 	fr := &fakeCooldRunner{}
 	err := CooldRevoke(context.Background(), fr, "h1", "root", 22, 8443, "wg0", "t", "")
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Empty(t, fr.calls, "no SSH call for empty id")
 }
 
@@ -167,7 +167,7 @@ func TestFetchCooldToken_ReadsFile(t *testing.T) {
 func TestFetchCooldToken_EmptyErrors(t *testing.T) {
 	fr := &fakeCooldRunner{}
 	_, err := FetchCooldToken(context.Background(), fr, "h1", "root", 22)
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "is empty")
 }
 

internal/wireguard/subnet_test.go

@@ -200,7 +200,7 @@ func TestAllocate_DuplicateHost_Errors(t *testing.T) {
 	hosts := []string{"1.1.1.1", "1.1.1.1"}
 
 	_, _, err := Allocate(pool, 24, nil, hosts)
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "duplicate host")
 }
 
@@ -210,7 +210,7 @@ func TestAllocate_PoolExhaustion(t *testing.T) {
 	hosts := []string{"h1", "h2"}
 
 	_, _, err := Allocate(pool, 28, nil, hosts)
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "exhausted")
 }