test: lift statement coverage from 2.5% to 91.9%

[TeoSlayer]

Summary

• Adds structural unit tests for every adapter the runtime package owns: streams, handshake, policy, events, trust, lifecycle.
• Lifts test coverage on origin/main from 2.5% (smoke test only) to 91.9%.
• All tests exercise the real daemon surface — no shadow fakes for production paths.

Coverage delta

Baseline	After
2.5% (origin/main, smoke test only)	91.9%
72.7% (with author's pre-existing untracked tests at session start)	91.9%

go test -race -count=1 -timeout 180s ./... passes.

What landed

• zz_adapters_test.go — HandshakeRuntime / PolicyRuntime / HandshakeServiceAdapter read-only paths
• zz_deps_test.go — Runtime.StartPlugins / StopPlugins / Deps wiring (Streams, Identity, Events)
• zz_handshake_adapter_test.go — ApproveHandshake / RevokeTrust shim delegation
• zz_listener_test.go — daemonListener Accept-after-Close + Port accessor
• zz_policy_manager_test.go — full policyManagerAdapter + runnerAdapter delegation (every method, both error and happy paths)
• zz_trust_test.go — asCoreapiTrust nil-bridge + delegate
• zz_streams_ceiling_test.go — pushes Dial / SendDatagram / Listen error path / TrustedPeers loop body / IsTrusted-with-registered-checker / DialAndSend error path / streamAdapter accessors+Read EOF+Write error / RejectHandshake+SendRequest shims
• zz_eventbus_internal_test.go — covers daemonEventBus nil-daemon early-return branches (internal-package test)

Ceiling-bound (genuinely untestable from a single-process unit test)

These 7 functions sit at 36–75% and cannot reach 100% without standing up a live daemon with identity + registry + a peer that completes a 3-way handshake:

Function	%	Why
HandshakeRuntime.DialAndSend	36.4%	Success path needs SendData on an ESTABLISHED connection — requires real SYN/SYN-ACK/ACK exchange against a peer daemon.
HandshakeRuntime.PublicKey, Sign, IdentityAdapter.PublicKey, Sign	75%	Happy path needs d.identity != nil. The daemon only sets that inside Start(), which requires a working RegistryAddr. The nil branches are covered.
HandshakeRuntime.Registry	75%	Happy path needs regConn != nil, only set by Start() → registry. The nil branch is covered.
daemonStreams.Dial	75%	Happy path needs newStreamAdapter to wire a successfully-dialed conn — i.e. live tunnel handshake. The cancelled-ctx and other error branches are covered.

Test plan

• go test -race -count=1 -timeout 180s ./... passes locally
• go tool cover -func=... reports 91.9% total
• CI confirms the same on a clean checkout

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️