Add clone_preserves_plain_value test for SecretString. Mark defensive
invariant branch in lua.rs lookup_input with cov-excl-line.

Assisted-by: GLM-5.1 via pi

diff --git a/src/ci/lua.rs b/src/ci/lua.rs
index 6dc7ad8..8a14ffc 100644
--- a/src/ci/lua.rs
+++ b/src/ci/lua.rs
@@ -249,8 +249,9 @@ fn lookup_input(lua: &Lua, name: String) -> mlua::Result<mlua::Value> {
         .as_ref()
         .ok_or_else(|| mlua::Error::external("(jobs ...) called outside a job's run-fn"))?;
     let view = rt.inputs.get(calling).ok_or_else(|| {
-        mlua::Error::external(format!("no inputs view for calling job '{calling}'"))
-    })?;
+        // cov-excl-line
+        mlua::Error::external(format!("no inputs view for calling job '{calling}'")) // cov-excl-line
+    })?; // cov-excl-line
     match view.get(&name) {
         Some(Some(value)) => Ok(value.clone()),
         Some(None) => Ok(mlua::Value::Nil),
diff --git a/src/fennel.rs b/src/fennel.rs
index dc4b553..a1f63bf 100644
--- a/src/fennel.rs
+++ b/src/fennel.rs
@@ -205,7 +205,7 @@ fn extract_line_offset(err: &mlua::Error) -> Option<usize> {
 /// Convert a 1-based line number to a byte offset in the source.
 fn line_offset(source: &str, line: usize) -> Option<SourceOffset> {
     if line == 0 {
-        return None; // cov-excl-line
+        return None;
     }
     let mut current_line = 1;
     for (i, ch) in source.char_indices() {
@@ -216,7 +216,7 @@ fn line_offset(source: &str, line: usize) -> Option<SourceOffset> {
             current_line += 1;
         }
     }
-    None // cov-excl-line
+    None
 }
 
 #[cfg(test)]
@@ -388,4 +388,15 @@ mod tests {
             "expected Empty error for nil result"
         );
     }
+
+    #[test]
+    fn line_offset_returns_none_for_line_zero() {
+        assert!(super::line_offset("hello", 0).is_none());
+    }
+
+    #[test]
+    fn line_offset_returns_none_when_line_exceeds_source() {
+        // Source has 2 lines, ask for line 10.
+        assert!(super::line_offset("line1\nline2\n", 10).is_none());
+    }
 }
diff --git a/src/secret.rs b/src/secret.rs
index 0778bdb..2d54d5a 100644
--- a/src/secret.rs
+++ b/src/secret.rs
@@ -137,6 +137,13 @@ mod tests {
         assert_eq!(secret.reveal().unwrap(), "plain_value");
     }
 
+    #[test]
+    fn clone_preserves_plain_value() {
+        let secret = SecretString::from_plain("clonable");
+        let cloned = secret.clone();
+        assert_eq!(cloned.reveal().unwrap(), "clonable");
+    }
+
     #[test]
     fn reveal_caches_file_value() {
         let dir = tempfile::tempdir().expect("tempdir");