test(cli): keep the xAI get line out of assertion messages CodeQL flags

CodeQL's rust/cleartext-logging query reported two new high alerts on #6715
at the two asserts added with the "token availability unprobed" check, which
interpolated `get` into the failure message. Both are false positives:
`get` comes from xai_get_line, which builds its text from fixed literals and
the &'static str labels of XaiRuntimeApiKey::source_name, never from key
bytes, and an assertion message is not a log. The taint is the runtime
API-key resolver being an input to the function.

Drop the interpolation from those two asserts and use static messages so the
check can go green without a dismissal. No behaviour change, no product code
touched. Revert this commit if the alerts are dismissed instead.

Evidence: cargo test -p codewhale-cli --lib -- xai_ auth_ owned_oauth:
33 passed; clippy (CI policy) on tui and cli --all-targets clean.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Signed-off-by: CodeWhale Bot <[email protected]>

crates/cli/src/lib.rs

@@ -10266,8 +10266,19 @@ verbosity = "concise"
         // #6715 review: no surface says "storage unprobed" for a route whose
         // generation `auth status` opens for the account label; only the
         // token's availability is left unverified.
-        assert!(get.contains("token availability unprobed"), "{get}");
-        assert!(!get.contains("storage unprobed"), "{get}");
+        // The assertion messages deliberately do not interpolate `get`: it is
+        // built from fixed source labels only, but it flows from the runtime
+        // API-key resolver, so CodeQL's cleartext-logging query treats a
+        // formatted copy as a credential sink. The two asserts above already
+        // print the line on failure.
+        assert!(
+            get.contains("token availability unprobed"),
+            "the xAI get line must say only token availability is unprobed"
+        );
+        assert!(
+            !get.contains("storage unprobed"),
+            "the xAI get line must not say storage is unprobed"
+        );
         assert!(!scoped.contains("storage unprobed"), "{scoped}");
         assert!(
             !keyring.queried().iter().any(|slot| slot == "xai"),