Release 5.16.2: BIMI x/y attribute fix; narrower dnssec exceptions

[seanthegeek]

Summary

A self-audit against the principle that tests should assert on observable behavior — not just exercise lines — turned up a handful of tests written purely to chase coverage. Several of them sat on top of unfixed bugs and even labeled themselves as such. This PR removes those tests, fixes the underlying bug they were hiding, and narrows a broad exception handler that one of them depended on.

Bug fix

• BIMI: forbidden SVG x/y attributes are now actually rejected. get_svg_metadata was reading svg["x"] / svg["y"], but xmltodict prefixes attributes with @, so those keys only match child elements — which real SVGs don't have. Net effect: the existing check_svg_requirements rejection of x/y attributes on the root <svg> element has been a no-op. Switched to @x / @y and fixed a typo where the y-value was being written to metadata["x"].

Test cleanup

• Removed TestSvgMetadataExtraAttributes (tests/test_bimi.py). Built malformed SVGs with child <x> / <y> / <description> / <overflow> elements to hit branches that are unreachable from real SVG input. One test even openly stated: "The branch wrote to metadata['x'] (not metadata['y']) per the source bug — the goal here is line coverage, not correctness."
• Replaced with one honest end-to-end test that constructs a real SVG with x="0" y="0" attributes, asserts they're captured, and asserts check_svg_requirements flags them.
• Removed testKnownGoodMocked (tests/test_init.py). Patched all nine check_* helpers to return canned valid dicts, then asserted the canned values came back. The network counterpart testKnownGood is the real test.
• Removed testValidationExceptionContinues (tests/test_dnssec.py). Existed only to exercise the broad except Exception clause we're narrowing here.

Convention compliance

• Narrowed three except Exception clauses in checkdmarc/dnssec.py to except (dns.exception.DNSException, OSError, EOFError) per AGENTS.md's "Don't catch Exception broadly" rule.

Coverage impact

Total coverage 96% (small honest drop). The lost percentage points represent branches that were either unreachable, buggy, or exercised tautologically — nothing of real value.

Test plan

• ruff check --show-fixes — clean
• python -m pytest tests/ — 433 passed, 10 skipped (network tests on CI)
• New testRootXYAttributesCaptured proves the BIMI fix works end-to-end
• CI passes on this branch

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.34%. Comparing base (0fb62ac) to head (a8a8748).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #254      +/-   ##
==========================================
- Coverage   96.39%   96.34%   -0.05%     
==========================================
  Files          24       24              
  Lines        5715     5695      -20     
==========================================
- Hits         5509     5487      -22     
- Misses        206      208       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.