fix: audit remediation - monkeypatch cleanup and code quality

Key changes:
- Add cleanupMonkeypatch() to restore util.debuglog after tests
- Add guard to prevent double-patching in setupMonkeypatch()
- Use null coalescing for CI env vars (avoids 'undefined' in URLs)
- Add comments explaining design decisions (internal APIs, token exposure)
- Remove double cast in actions.ts
- Fix lazy assertions in test-prerequisites.spec.ts
- Add type guards to catch blocks in engine.ts
- Clarify schema.json boolean descriptions
- Delete TEST_COVERAGE_PLAN.md (stale)
- Add no-test-counts rule to CLAUDE.md
- Add cleanup to all test files that use prepareOptions

Author: JohannesHoppe

CLAUDE.md

@@ -209,6 +209,7 @@ The engine appends CI metadata to commit messages when running on:
 - Uses Jest (`npm test`), tests in `*.spec.ts` files
 - Requires git clone with `origin` remote (see `test-prerequisites.spec.ts`)
 - All tests preserve/restore `process.env` using `originalEnv` pattern
+- **No test counts in documentation** - they become stale quickly and are bragging
 
 ### Testing Rules
 

README.md

@@ -428,6 +428,7 @@ This can be very useful because it outputs what would happen without doing anyth
 
 To avoid all these command-line cmd options, you can write down your configuration in the `angular.json` file in the `options` attribute of your deploy project's architect. Just change the kebab-case to lower camel case. Commonly used options in lower camel case (see `src/deploy/schema.json` for the complete list including deprecated options):
 
+<!-- deprecated options (browserTarget, noSilent) hidden per deprecation policy -->
 - baseHref
 - buildTarget
 - prerenderTarget

TEST_COVERAGE_PLAN.md

@@ -89,6 +89,6 @@ export default async function deploy(
   await engine.run(
     dir,
     options,
-    (context.logger as unknown) as logging.LoggerApi
+    context.logger
   );
 }

src/deploy/actions.ts

@@ -60,7 +60,7 @@
     },
     "noDotfiles": {
       "type": "boolean",
-      "description": "Includes dotfiles by default. Execute with --no-dotfiles to ignore files starting with `.`.",
+      "description": "Exclude dotfiles (files starting with `.`) from deployment.",
       "default": false
     },
     "noNotfound": {
@@ -70,7 +70,7 @@
     },
     "noNojekyll": {
       "type": "boolean",
-      "description": "By default a .nojekyll file is created, because we assume you don't want to compile the build again with Jekyll.",
+      "description": "Skip creating the .nojekyll file.",
       "default": false
     },
     "cname": {