test: close the sweep across the remaining modules

[Jaro-c]

Fourth and last pass of #229, over auth/email, auth/username, internal/keymanager and the injected-material path in keystore.

Sixteen guards mutated, fifteen already covered. That is the first pass that came back mostly clean, and it is worth saying plainly rather than presenting the one finding as though the module were riddled. auth/username and the key-material validation in internal/keymanager — private and public key lengths, the pair matching, the refresh-secret length, the partial-directory refusal — all detected their own deletion.

The one survivor

auth/email's 254-character total length. TestValidate_tooLong built a 249-character local part, so the 64-character local-part rule refused it first and the total was never measured. Same shape as the size-cap tests in #227 and the PHC bounds in #234: the fixture violated more than one rule, and an earlier guard fired.

An address that reaches it has to be assembled from parts that are each individually legal — a 60-character local part and 60-character DNS labels — with a companion test asserting the same shape just under the limit is accepted. Without that second assertion the first would be satisfied by any rejection at all, which is the whole failure mode being fixed.

Loader gaps in internal/keymanager

• The cleanup that removes a freshly written private key when the public write fails was the largest single gap in the package, at 55.6%. It is unreachable through New — checkKeyDirConsistency refuses a partial directory before generation is attempted — so it is driven directly, and asserts the private key does not survive rather than that an error came back. Planting a directory where a file should go makes the write fail on any platform, with no permission games.
• An unreadable descriptor is now distinguished from an absent one. Absent means the pre-marker layout and is adopted in place; unreadable means the loader cannot tell what wrote the directory and has to fail closed. Those are opposite behaviours from one missing file.
• KeyID had been reading as 0% while being exercised from the JWT module next door. It has its own assertion now, so the number stops lying.

Measured

package	before	now
internal/keymanager	88.9%	92.0%
auth/email	90.9%	91.9%
total	92.3%	92.9%

Every package is over 90% for the first time, which settles the substantive half of #218 — no package is hiding under the aggregate any more. The policy question there, whether the gate should be per-package, is unaffected and still open.

go vet, golangci-lint (0 issues) and go test -race ./... pass. Each new test was confirmed by deleting the control it names and watching it fail.