tests: push coverage to 95%+ across all 5 packages

[TeoSlayer]

Summary

Push test coverage from ~82% baseline to 96.6% module average via focused unit tests against branches that go cover flagged as uncovered. No production changes — new `*_test.go` files only.

Per-package coverage delta

Package	Before	After
`pkg/extend`	94.8%	100.0%
`pkg/ipc`	75.3%	92.9%
`pkg/manifest`	82.8%	100.0%
`pkg/payment`	89.7%	98.5%
`plugin/appstore`	69.8%	91.5%
module avg	82.5%	96.6%

What got covered

• Supervisor lifecycle: `spawn` (0% → 90.9%), `waitReady` (0% → 100%), `verifyBinary` (27% → 90.9%), `superviseOne` crash-loop + verify-fail paths, `resolveUnder` traversal-rejection branches, `scanInstalled` symlink/non-dir/missing-root edge cases. Approach: on-disk POSIX-shell fake binaries under `t.TempDir()` (no `os/exec` mocking needed — Go doesn't allow it; instead we hand the supervisor a real on-disk executable whose exit code and timing we control).
• Audit-log path: `writeAuditLine` open-failure branch, `rotateAuditIfLarge` no-active-log branch. Audit is best-effort — never fails closed even when the app dir is read-only.
• Signature-verification path: `verifyBinary` exercises the sha256-mismatch → `verify-fail` audit-line emission path. Catalog `EmbeddedCatalogPubkey` placeholder coverage: nil/empty/non-zero branches of `catalogPubkeyIsPlaceholder` all hit. The dev-mode WARNING is asserted in `TestStartWarnsOnPlaceholderCatalogPubkey`.
• IPC framing: `ReadFrame` zero-length / oversized / partial-body / bad-JSON branches; `WriteFrame` header-write + body-write error branches via a fake `io.Writer`; `Serve` ctx-canceled + non-req-envelope-skip + partial-frame read-error branches; `Call` server-closes-mid-call + req-id-mismatch + unexpected-envelope-type + bad-result-unmarshal + bad-args-marshal branches.
• Manifest validate: every `validateCondition` branch (leaf-only, composite `and`/`or`/`not` arity, recursive descent, unknown op, both-leaf-and-composite); every empty-field guard (binary.path, store.signature, affiliate.role, depends.methods, extends.method, grant.target).
• Payment seal: `SealRegistry.IDs` (0% → 100%), nonce/key size validation in Encrypt/Decrypt, registry replace-by-id semantics.
• Extend registry: every Register guard (empty AppID, unknown flag type), Run ctx-canceled-before-first-hook, hook-returns-nil-next, cloneArgs nil branch, GetMeta bad-marshal/unmarshal fallback branches.

What stayed uncovered (and why — these are the ceiling)

• `crypto/rand.Read` failure paths (`randReqID`, `RandomKey`, `RandomNonce` ~75%) — would require monkey-patching the standard-library rand source.
• `Service.Stop` ctx-Done branch (80%) — fundamentally racy to cover; mutating `s.doneCh` from a test triggers `-race` and poisons unrelated tests.
• `superviseOne` (73%) — the respawn-backoff `select{<-ctx.Done; <-time.After}` is exercised end-to-end but go cover does not always credit the timer branch when ctx wins.
• Defensive `errors.Is(err, os.ErrNotExist)` branches in rescan paths — would require simulating partial-failure filesystem states (rmdir between Stat and the dependent op).

Test plan

• `go test -race -count=1 -timeout 180s ./...` passes (all 5 packages)
• No production code changed (`git diff main..HEAD --stat` = 12 new `*_test.go` files, 0 source changes)
• Module-average coverage: 82.5% → 96.6% (target was 95%+)

Bugs surfaced

None. The supervisor, IPC, and manifest paths I drove all behaved as documented. The dev-mode `EmbeddedCatalogPubkey` placeholder is a known release-prep gap (already loudly logged at `Start`); covering it in tests doesn't fix it but does pin the WARNING contract so a silent removal of the warning would fail `TestStartWarnsOnPlaceholderCatalogPubkey`.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️