The type is a map of host to headers, not a flat header set. Name it after
that shape, and rename the fields carrying it to authHeadersByHost so the
lookup step is visible at every call site.
Claude-Session: https://claude.ai/code/session_01KNPMznEzkRpxFZMLisjdqL
map[string]map[string]string named neither key. The type already existed
in taskfile; package task reaches it through setup.go, so only an import
was missing. Callers keep passing a plain map literal, which stays
assignable to a named map type.
Authenticating a remote Taskfile so far meant putting the credential in the
include URL, where it leaks into error messages and the confirmation prompt.
`remote.auth` configures free-form headers per host instead, so the URL stays
safe to commit. Values may reference environment variables with ${VAR}.
The headers are injected by a RoundTripper rather than set on the request:
that covers the HEAD probe RemoteExists issues before the GET, and keeps a
cross-host redirect from carrying the credentials. They are resolved when the
request is about to be made, so a cached or offline run does not require a
token it will never send.
* docs: Update Remote Taskfiles default values
This change updates the documentation for [Remote Taskfiles > Configuration](https://taskfile.dev/docs/experiments/remote-taskfiles#configuration) for `timeout` and `cache-expiry` to match the defaults in code.
* docs: Update `cache-expiry` default to 0s
* docs: Update executor.go comment
Fix doc comment to indicate that cache expiry default duration is 0.
* feat: use TaskTest for executor tests
* feat: more tests
* feat: separate tests for executing and formatting with new functional options that work for both test types
* feat: formatter tests
* refactor: more tests
* refactor: executor functional options
* refactor: minor tidy up of list code
* fix: WithVersionCheck missing from call to NewExecutor
* feat: docstrings for structs with functional options
* refactor: prefix the functional options with the name of the struct they belong to
