Test-support code exists to hand a test privileges the program itself
must never have, so it must not be compiled into the shipped binary.
depguard now states that rule: in files that are neither tests nor
inside a package whose directory name ends in test, the denied imports
are refused.
depguard matches an import path against a list of prefixes, so it
cannot be told "any path whose last segment ends in test". A repo's own
test-support packages therefore have to be named one at a time under
deny, by full import path, and the policy paragraph now says that list
is the one part of the vendored copy a repo may extend.
Requested by sneak on
sneak/homoicon#1029 to replace a
per-repository check written as a Go test.
Model: opus-5
