[puncsky]

Summary

Keep the local-path bytes in NAME:LOCAL_PATH instead of trimming them. Continue trimming the secret target name and rejecting an empty or whitespace-only path.

Motivation

A quoted filename ending in whitespace can otherwise select a different existing neighbor and upload its contents. Filesystem lookup should use the path the caller supplied.

How to verify

go test ./cmd/... ./pkg/... ./internal/...

• All 57 development packages pass on the candidate.
• Parser tests distinguish target-name formatting from literal paths. Real file-resolution tests cover trailing space/tab/newline, a missing suffixed file beside an existing neighbor, interior spaces and colons. Filesystem-specific fixtures skip on Windows. Reintroducing path trimming fails the wrong-file regression.
• New-code lint is clean against c31e586e; full lint on unmodified main reports 92 pre-existing findings with the pinned golangci-lint v2.14.0.

Release notes

Secret-file uploads use the exact local file path passed to the CLI.