fix(auth): loosen brittle scope-command test, add default-flag drift test

- auth_scopes_lists_every_scope_with_live_commands asserted the
  domains.domain:create scope's command list equals exactly ["domain
  purchase"], which would break if a future command legitimately
  requires the same scope. Assert containment instead.
- Add scope_registry_default_flag_matches_default_oauth_scopes: closes
  the gap SCOPE_REGISTRY's own doc comment flagged (no automated check
  that its `default` flag matches
  environments::DEFAULT_OAUTH_SCOPES), so a drift here can no longer
  silently make `gddy auth scopes --defaults-only` misleading.

Author: jpage-godaddy

rust/src/scopes.rs

@@ -132,9 +132,9 @@ pub struct ScopeInfo {
 
 /// Every requestable scope, described for `gddy auth scopes`. Keep in sync
 /// with the constants above (`scope_registry_covers_every_declared_scope`
-/// enforces the constant side of this; there's no automated check for the
-/// `default` flag — cross-check
-/// [`crate::environments::DEFAULT_OAUTH_SCOPES`] when adding a scope here).
+/// enforces the constant side of this; `scope_registry_default_flag_matches_default_oauth_scopes`
+/// enforces that the `default` flag exactly matches
+/// [`crate::environments::DEFAULT_OAUTH_SCOPES`]).
 pub const SCOPE_REGISTRY: &[ScopeInfo] = &[
     ScopeInfo {
         scope: APP_REGISTRY_READ,
@@ -313,4 +313,28 @@ mod tests {
             );
         }
     }
+
+    /// [`SCOPE_REGISTRY`]'s `default` flag must exactly match
+    /// [`crate::environments::DEFAULT_OAUTH_SCOPES`] — the module doc on
+    /// [`SCOPE_REGISTRY`] used to call this out as an unenforced invariant;
+    /// this is that check. If they drift, `gddy auth scopes --defaults-only`
+    /// would misdescribe which scopes actually get requested at login.
+    #[test]
+    fn scope_registry_default_flag_matches_default_oauth_scopes() {
+        let default_in_registry: std::collections::HashSet<&str> = SCOPE_REGISTRY
+            .iter()
+            .filter(|info| info.default)
+            .map(|info| info.scope)
+            .collect();
+        let default_oauth_scopes: std::collections::HashSet<&str> =
+            crate::environments::DEFAULT_OAUTH_SCOPES
+                .iter()
+                .copied()
+                .collect();
+        assert_eq!(
+            default_in_registry, default_oauth_scopes,
+            "SCOPE_REGISTRY's `default` flags must match \
+             crate::environments::DEFAULT_OAUTH_SCOPES exactly"
+        );
+    }
 }

rust/src/scopes_cmd.rs

@@ -199,7 +199,7 @@ mod tests {
             .iter()
             .map(|c| c.as_str().expect("command is a string"))
             .collect();
-        assert_eq!(commands, vec!["domain purchase"]);
+        assert!(commands.contains(&"domain purchase"));
     }
 
     /// `--command` is a reverse lookup: given a command path, return exactly