test: add unit tests and a local Docker test runner

- Unit tests for calculate_page_iv (incl. 8-byte wrap), calculate_file_iv round-trip, and game-key lookup
- Extract exfat_utc_offset_seconds and nt_timestamp_to_system_time as pure helpers and test them (covers the recent exFAT UtcOffset fix)
- scripts/test.sh runs cargo test + a smoke test natively, then repeats for the x86_64-musl target in a clux/muslrust container (no hosted CI needed)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/test.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+#
+# Local test runner (no hosted CI). Runs the unit tests and a smoke test
+# natively, then — when Docker is available — repeats them for the Linux
+# x86_64-musl release target inside a container, so both targets can be
+# validated from any host without a CI runner.
+#
+# Usage:
+#   scripts/test.sh            # native tests + Docker linux/musl (if Docker present)
+#   scripts/test.sh --no-docker  # native only
+#
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+use_docker=1
+[ "${1:-}" = "--no-docker" ] && use_docker=0
+
+# --- helpers ---------------------------------------------------------------
+
+smoke() {
+    # $1 = path to a fsdecrypt binary
+    local bin="$1"
+    "$bin" --version
+    local junk
+    junk="$(mktemp --suffix=.app 2>/dev/null || echo "${TMPDIR:-/tmp}/fsd_junk.app")"
+    head -c 4096 /dev/urandom > "$junk"
+    # Garbage input must fail gracefully (non-zero exit), never panic.
+    if "$bin" "$junk"; then
+        echo "ERROR: expected a non-zero exit on garbage input" >&2
+        rm -f "$junk"; return 1
+    fi
+    rm -f "$junk"
+    echo "smoke test passed"
+}
+
+# --- native ----------------------------------------------------------------
+
+echo "==> cargo test (native)"
+cargo test --locked
+
+echo "==> cargo build --release (native)"
+cargo build --release --locked
+
+native_bin="target/release/fsdecrypt"
+[ -f "$native_bin.exe" ] && native_bin="$native_bin.exe"
+echo "==> smoke test (native)"
+smoke "$native_bin"
+
+# --- Linux x86_64-musl via Docker ------------------------------------------
+
+if [ "$use_docker" = "1" ] && command -v docker >/dev/null 2>&1; then
+    echo "==> Docker: cargo test + release build for x86_64-unknown-linux-musl"
+    # Use a docker-friendly host path (Git Bash on Windows needs the C:/... form).
+    host_path="$PWD"
+    case "$(uname -s)" in
+        MINGW*|MSYS*|CYGWIN*) host_path="$(pwd -W)" ;;
+    esac
+    MSYS_NO_PATHCONV=1 docker run --rm \
+        -v "$host_path:/volume" -w /volume \
+        -e CARGO_TARGET_DIR=/volume/target-musl \
+        clux/muslrust:stable \
+        bash -c '
+            set -e
+            cargo test --locked
+            cargo build --release --locked
+        '
+    echo "==> smoke test (linux/musl)"
+    MSYS_NO_PATHCONV=1 docker run --rm \
+        -v "$host_path:/volume" -w /volume \
+        clux/muslrust:stable \
+        ./target-musl/x86_64-unknown-linux-musl/release/fsdecrypt --version
+    echo "linux/musl checks passed"
+elif [ "$use_docker" = "1" ]; then
+    echo "==> Docker not found — skipping Linux/musl checks (run with --no-docker to silence)"
+fi
+
+echo "All checks passed."