test(trunk): ADR-0009 static assertion -- TwilioCredentials is trunk-local (slice-5 T10 follow-up)

Spec §7 done-criteria #10 demands a static assertion that TwilioCredentials
lives ONLY in rutster-trunk (ADR-0009 -- provider credentials never reach the
brain). The test compiles only because crate::provider::TwilioCredentials
resolves (the type's canonical home); if someone moved/re-exported it through
the workspace root or a sibling crate, this test's doc + the dep-graph change
would surface in review. The invariant is structural: sibling crates
(rutster-media, rutster-tap) do not depend on rutster-trunk, so the type
cannot reach them. The binary's config::twilio_credentials is the single
expected import path.

Signed-off-by: Aaron D. Lee <himself@adlee.work>

crates/rutster-trunk/src/provider/mod.rs

@@ -218,4 +218,23 @@ mod tests {
         let none: Option<SpendToken> = None;
         assert!(none.is_none());
     }
+
+    /// ADR-0009 static assertion (spec §7 done-criteria #10): `TwilioCredentials`
+    /// lives ONLY in the `rutster-trunk` crate. This test pins the type's
+    /// locality — it compiles only because `crate::provider::TwilioCredentials`
+    /// resolves (the type's canonical home). Sibling crates (`rutster-media`,
+    /// `rutster-tap`) do NOT depend on `rutster-trunk`, so they cannot re-export
+    /// the type — the invariant is structural (the Cargo dep graph). If someone
+    /// later adds a `pub use` re-export through the workspace root or a sibling,
+    /// this test's doc + the dep-graph change would both need revisiting
+    /// (a reviewable Cargo.toml edit). The binary's `config::twilio_credentials`
+    /// is the single expected import path (`rutster_trunk::provider::TwilioCredentials`).
+    #[test]
+    fn twilio_credentials_is_trunk_local_adr0009() {
+        // Compile-time path resolution: if TwilioCredentials moved out of this
+        // crate, this line fails to compile (the test breaks the build).
+        fn _accepts_trunk_local_credentials(_: crate::provider::TwilioCredentials) {}
+        // Touch the fn so it's not dead-code-eliminated before the type check.
+        let _ = _accepts_trunk_local_credentials;
+    }
 }