* test(qa): cover CLI onboarding and plugin sources * test(qa): assert npm file plugin source * test(qa): redact onboarding password assertion * test(qa): retain onboarding evidence log