add detailed API tests checking how calls to PGPAgent propagate to the underlying interface

this is refactoring support, so that we can notice changes in how the
underlying APIs are called, and make changes intentionally when needed,
instead of accidentally.

passKitTests/Mocks/MockPGPInterface.swift

@@ -0,0 +1,70 @@
+//
+//  MockPGPInterface.swift
+//  passKitTests
+//
+
+import Foundation
+@testable import passKit
+
+class MockPGPInterface: PGPInterface {
+    // MARK: - Configuration
+
+    var keyIDs: [String] = []
+    var shortKeyIDs: [String] = []
+    var publicKeyIDs: Set<String> = []
+    var privateKeyIDs: Set<String> = []
+
+    var decryptResult: Data?
+    var decryptError: Error?
+    var encryptResult = Data()
+    var encryptError: Error?
+
+    // MARK: - Call tracking
+
+    struct DecryptCall {
+        let encryptedData: Data
+        let keyID: String?
+        let passphrase: String
+    }
+
+    struct EncryptCall {
+        let plainData: Data
+        let keyID: String?
+    }
+
+    var decryptCalls: [DecryptCall] = []
+    var encryptCalls: [EncryptCall] = []
+    var containsPublicKeyCalls: [String] = []
+    var containsPrivateKeyCalls: [String] = []
+
+    // MARK: - PGPInterface
+
+    func decrypt(encryptedData: Data, keyID: String?, passphrase: String) throws -> Data? {
+        decryptCalls.append(DecryptCall(encryptedData: encryptedData, keyID: keyID, passphrase: passphrase))
+        if let error = decryptError {
+            throw error
+        }
+        return decryptResult
+    }
+
+    func encrypt(plainData: Data, keyID: String?) throws -> Data {
+        encryptCalls.append(EncryptCall(plainData: plainData, keyID: keyID))
+        if let error = encryptError {
+            throw error
+        }
+        return encryptResult
+    }
+
+    func containsPublicKey(with keyID: String) -> Bool {
+        containsPublicKeyCalls.append(keyID)
+        return publicKeyIDs.contains { $0.hasSuffix(keyID.lowercased()) }
+    }
+
+    func containsPrivateKey(with keyID: String) -> Bool {
+        containsPrivateKeyCalls.append(keyID)
+        return privateKeyIDs.contains { $0.hasSuffix(keyID.lowercased()) }
+    }
+
+    var keyID: [String] { keyIDs }
+    var shortKeyID: [String] { shortKeyIDs }
+}