fix: resolve spurious dry-run diffs for rules, themes, and hooks

[ankita10119]

🔧 Changes

Fixes three sources of spurious dry-run diffs that caused a clean export-then-dry-run cycle to propose changes when none existed.

Rules (handlers/rules.ts)
dryRunChanges was delegating to calcChanges, which internally runs the duplicateItems suffix-generation path. This caused every rule in the tenant to appear twice in the diff, once under its real name and once with a random suffix (e.g. Add voucherID to AccessToken-betv2).
Fixed by calling calculateDryRunChanges directly, which performs a clean name-based comparison without any renaming side-effects.

Themes (handlers/themes.ts)
Themes are singletons, but a default export strips themeId from the local file (because AUTH0_EXPORT_IDENTIFIERS defaults to false).
Without a themeId, the dry-run matcher found no match for the local theme and proposed a CREATE + DELETE on every run. Fixed by adding a dryRunChanges override that backfills themeId from the remote singleton before comparison, so the matcher resolves correctly without requiring AUTH0_EXPORT_IDENTIFIERS.

Hooks (handlers/hooks.ts)
getType was destructuring { data: secrets } from the secrets response, but the SDK returns the object directly. This meant secrets were always undefined locally, causing hooks with secrets to appear changed on every dry run. Fixed by removing the .data unwrap.

📚 References

🔬 Testing

Unit tests added/extended for all three fixes:

• test/tools/auth0/handlers/dryRun.tests.ts - new rules clean-cycle test (no creates/updates/deletes after a clean export), and two new themes regression tests (no themeId → no create/delete; content diff → update only)
• test/tools/auth0/handlers/themes.tests.js - new#themes dryRunChanges describe block with 5 cases covering the
  backfill logic, content-diff detection, and null-guard behaviour

All 37 affected tests pass (npm test).

For end-to-end validation: export any tenant, immediately run--dry-run against the same tenant with the same exported file - rules, themes, and hooks should all show zero proposed changes.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 81.81818% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.17%. Comparing base (fb20e68) to head (c86207a).

Files with missing lines	Patch %	Lines
src/tools/auth0/handlers/rules.ts	63.63%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1437      +/-   ##
==========================================
- Coverage   80.23%   80.17%   -0.06%     
==========================================
  Files         163      163              
  Lines        7533     7552      +19     
  Branches     1663     1668       +5     
==========================================
+ Hits         6044     6055      +11     
- Misses        800      805       +5     
- Partials      689      692       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[harshithRai]

Small thing: getType() returns null when no-code isn't enabled (the 400 case in getThemes), and passing that straight into calculateDryRunChanges will blow up on [null]. The rules fix in this same PR guards it - could we do the same here?

const existing = await this.getType();
if (existing === null) {
  return { del: [], create: [], conflicts: [], update: [] };
}