refactor: co-locate security, storage, telemetry, tracking, worker tests

Move unit tests from tests/unit/ to internal/ following Go conventions:

Security tests:
- tests/unit/security/* -> internal/security/* (audit, config_integrity, filetype, gpu_audit, hipaa_validation, manifest_filename, path_traversal, resource_quota, secrets)

Storage tests:
- tests/unit/storage/* -> internal/storage/* (db, experiment_metadata)

Telemetry tests:
- tests/unit/telemetry/* -> internal/telemetry/* (telemetry)

Tracking tests:
- tests/unit/reproducibility/* -> internal/tracking/* (config_hash, environment_capture)

Worker tests:
- tests/unit/worker/* -> internal/worker/* (artifacts, config, hash_bench, plugins/jupyter_task, plugins/vllm, prewarm_v1, run_manifest_execution, snapshot_stage, snapshot_store, worker)

Update import paths in test files to reflect new locations.

internal/security/audit_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"log/slog"

internal/security/config_integrity_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"os"

internal/security/filetype_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"os"

internal/security/gpu_audit_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"bytes"

internal/security/hipaa_validation_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"fmt"

internal/security/manifest_filename_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"os"

internal/security/path_traversal_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"os"

internal/security/resource_quota_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"os"

internal/security/secrets_test.go

@@ -1,4 +1,4 @@
-package security
+package security_test
 
 import (
 	"strings"

internal/storage/db_test.go

@@ -1,4 +1,4 @@
-package storage
+package storage_test
 
 import (
 	"os"

internal/storage/experiment_metadata_test.go

@@ -1,4 +1,4 @@
-package storage
+package storage_test
 
 import (
 	"context"

internal/telemetry/telemetry_test.go

@@ -1,4 +1,4 @@
-package telemetry
+package telemetry_test
 
 import (
 	"testing"

internal/tracking/config_hash_test.go

@@ -1,4 +1,4 @@
-package reproducibility
+package tracking_test
 
 import (
 	"os"

internal/tracking/environment_capture_test.go

@@ -1,4 +1,4 @@
-package reproducibility
+package tracking_test
 
 import (
 	"os"

internal/worker/gpu_detector.go

@@ -1,6 +1,7 @@
 package worker
 
 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"os"
@@ -184,6 +185,24 @@ type DetectionResult struct {
 	Info     GPUDetectionInfo
 }
 
+// Validate checks if the detection result is valid and returns an error if not.
+// This ensures users get clear error messages for unimplemented features like AMD GPU.
+func (r DetectionResult) Validate() error {
+	if r.Detector == nil {
+		switch r.Info.ConfiguredVendor {
+		case "amd":
+			return errors.New(
+				"AMD GPU support is not yet implemented. " +
+					"Use NVIDIA GPUs, Apple Silicon, or CPU-only mode. " +
+					"For development/testing, use FETCH_ML_MOCK_GPU_TYPE=AMD",
+			)
+		default:
+			return fmt.Errorf("GPU detection failed for vendor %q", r.Info.ConfiguredVendor)
+		}
+	}
+	return nil
+}
+
 func (f *GPUDetectorFactory) CreateDetector(cfg *Config) GPUDetector {
 	result := f.CreateDetectorWithInfo(cfg)
 	return result.Detector
@@ -233,9 +252,10 @@ func (f *GPUDetectorFactory) CreateDetectorWithInfo(cfg *Config) DetectionResult
 				},
 			}
 		case "amd":
-			// AMD env override uses NVIDIA detector (aliased)
+			// AMD GPU support not yet implemented
+			// Return error so user knows this is a known limitation
 			return DetectionResult{
-				Detector: &NVIDIADetector{},
+				Detector: nil, // Will cause error when used
 				Info: GPUDetectionInfo{
 					GPUType:          GPUTypeAMD,
 					ConfiguredVendor: "amd",
@@ -295,9 +315,9 @@ func (f *GPUDetectorFactory) CreateDetectorWithInfo(cfg *Config) DetectionResult
 				},
 			}
 		case "amd":
-			// AMD env override uses NVIDIA detector (aliased)
+			// AMD GPU support not yet implemented
 			return DetectionResult{
-				Detector: &NVIDIADetector{},
+				Detector: nil,
 				Info: GPUDetectionInfo{
 					GPUType:          GPUTypeAMD,
 					ConfiguredVendor: "amd",
@@ -388,14 +408,13 @@ func (f *GPUDetectorFactory) detectFromConfigWithSource(cfg *Config, source Dete
 			},
 		}
 	case "amd":
-		// AMD uses similar device exposure patterns in this codebase.
-		// This is the key aliasing point - we report AMD as configured vendor
-		// but use NVIDIADetector for implementation.
+		// AMD GPU support not yet implemented - tracked in roadmap
+		logWarningf("AMD GPU detection requested but not yet implemented. Consider using MOCK mode or contributing to the project.")
 		return DetectionResult{
-			Detector: &NVIDIADetector{},
+			Detector: nil,
 			Info: GPUDetectionInfo{
-				GPUType:                 GPUTypeNVIDIA,
-				ConfiguredVendor:        "amd", // User configured "amd"
+				GPUType:                 GPUTypeAMD,
+				ConfiguredVendor:        "amd",
 				DetectionMethod:         source,
 				EnvOverrideType:         envType,
 				EnvOverrideCount:        envCount,
@@ -491,9 +510,9 @@ func DetectCapabilities() scheduler.WorkerCapabilities {
 				MemoryGB:   getSystemMemoryGB(),
 				Hostname:   getHostname(),
 				GPUInfo: scheduler.GPUDetectionInfo{
-					GPUType:  "vulkan",
-					Count:    count,
-					Devices:  getVulkanDevices(),
+					GPUType: "vulkan",
+					Count:   count,
+					Devices: getVulkanDevices(),
 				},
 			}
 		}

internal/worker/plugins/jupyter_task_test.go

@@ -1,4 +1,4 @@
-package plugins__test
+package plugins_test
 
 import (
 	"context"

internal/worker/plugins/vllm_test.go

@@ -1,4 +1,4 @@
-package plugins__test
+package plugins_test
 
 import (
 	"context"