test: push coverage from 76.1% to 90.1%

[TeoSlayer]

Summary

Bumps statement coverage from 76.1% → 90.1% by adding four new
*_test.go files that target previously-uncovered branches. No
production code changed.

Iter-2 audit follow-through

The audit flagged: skillinject symlink TOCTOU (downgraded to
FALSE_POSITIVE by the verification pass — originalBytes is an
immutable in-memory snapshot), snapshot rollback paths, .pilot-bak
handling, and cross-process file lock. This PR pins tests on the
real items: the snapshot+swap+verify happy path AND the rollback
machinery, plus .pilot-bak lifecycle (preferred-restore detection,
inverse-merge fallback, orphan cleanup, 0o600 file mode).

Coverage gaps closed

• mergePluginAllowList 64% → 72% (null-JSON re-init, disk error
  surfacing via reconcile outcome)
• removePluginAllowListEntry 25% → 81% (full path matrix)
• loadManifestForUninstall 27% → 100% (network/cache/no-cache/garbage)
• fetchManifest 77% → 100% (validation errors)
• Tick 83% → 90% (disabled short-circuit, entrypoint/heartbeat fetch
  • render failures)
• Stop 86% → 100% (graceful + ctx-deadline branches)
• logTick 43% → 100% (nil, error, non-nil report)
• classifyPluginFile / classifyPluginAllowList / verifyOnDiskResult
  / verifyMarshalRoundTrip micro-branches

Ceiling lines (why 90% and not 100%)

Remaining gaps are operationally-unreachable defensive branches:

• os.Rename / os.WriteFile / os.MkdirAll / os.Chmod error
  returns inside well-formed atomic write paths
• json.Marshal errors on map[string]any (only contains
  JSON-marshalable primitives)
• walkObject len(parts)==0 (strings.Split never returns empty)
• ensureAllowListEntry/EntryEnabled parent==nil (walkObject with
  create=true always materializes)
• mergePluginAllowList post-write rollback (needs in-process FS
  fault injection between rename and read-back; the unit-level
  machinery — verifyOnDiskResult failure + writeFileAtomic
  restore — is exercised directly in
  TestRollbackMachinery_RestoreFromInMemorySnapshot)

Pushing past 90% would require monkey-patching os or adding
indirection that costs more in fragility than it buys in confidence.

Test plan

• go test -race -count=1 -timeout 180s ./... passes
• No production code modified — diff is *_test.go only
• All file I/O via t.TempDir(); permission-based tests skip
  when euid==0
• Race-detector clean

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️