test(cli): cover body and config boundaries

[codemountains]

Summary

• add focused unit tests for CLI body transformation, including JSON, text, malformed JSON, invalid UTF-8, empty, multipart, binary, SSE base64, and sensitive-header redaction
• add focused tests for config path precedence and config parse/serialize behavior
• add real-filesystem tests for config read/write/delete, parent directory creation, and POSIX 0600 enforcement
• consolidate direct and SSE body transformation behind one behavior-preserving byte transformation core

Why

These branches were previously covered mainly through command-level tests. Focused tests now pin the domain and infrastructure behavior directly, including the credential file permission boundary.

The body refactor preserves the intentional invalid UTF-8 difference:

• direct event body: synthetic metadata
• SSE text/JSON body: original base64 string

Test-first workflow

The change began with characterization tests because Issue #100 targets existing behavior. All 30 initial tests passed before production refactoring. The body duplication was then consolidated under those tests, and path coverage was expanded to 32 focused tests.

Verification

• focused CLI tests: 3 files, 32 tests passed
• just ci-full: passed
  • typecheck, Biome, Markdown lint
  • 52 unit test files, 372 tests
  • coverage thresholds
  • Worker dry-run and OpenTofu validation/tests
  • smoke E2E
• just test-e2e: 1 file, 5 tests passed
• final just check: 52 files, 372 tests passed
• code-reviewer: no remaining findings
  • addressed the Medium finding by proving an existing 0644 config is restored to 0600 after rewrite

Documentation

No documentation changes are required because user-facing CLI, event, and config contracts are unchanged.

Closes #100