test(collectors): cover the six uncovered sub-line fallback regions

[hivecommons-hive]

Test Improvement

Closes the six uncovered sub-line regions in the three data collectors. Each
file already reported 100.00% line coverage, so these gaps were invisible
there: line coverage marks a line covered when any character on it ran, and a
|| default or a ternary arm that never executed hides behind the rest of its
line.

File	Line	Region now covered
scripts/collect-metrics.mjs	39	source.landscape || []
scripts/collect-metrics.mjs	41	subcategory.items || []
scripts/collect-metrics.mjs	45	category.name || 'Other'
scripts/collect-radar-reports.mjs	52	existing.radarReports || []
scripts/collect-launch-metrics.mjs	142	githubAll Authorization ternary, both arms

Files touched

• tests/helpers-script-sandbox.mjs — the githubAll Authorization pair
  needed a new capability, not a new fixture. The sandbox pins GH_TOKEN: ''
  so runs stay reproducible, and it had no way to observe outbound request
  headers, so nothing in the repository could assert what a collector actually
  sends. The stubbed fetch now appends {url, headers} to a per-run log and
  runScriptInSandbox returns it as requests. No existing caller changes
  behaviour; the field is additive.
• tests/collect-metrics.test.mjs — three cases: a landscape.yml with no
  landscape: key, a subcategory declaring no items, and an unnamed category
  falling back to the Other bucket.
• tests/collect-radar-reports.test.mjs — one case: an existing catalog file
  with no radarReports key is treated as empty rather than crashing the
  refresh.
• tests/collect-launch-metrics.test.mjs — two cases asserting on requests:
  the credential reaches every paginated collection request when GH_TOKEN is
  set, and no Authorization header is sent when it is not.

No production code is touched.

Verification

TZ=UTC node tests/tools/coverage-report.mjs, before → after:

scripts/collect-launch-metrics.mjs   | 100.00 |  96.77 |   ->  100.00 | 100.00
scripts/collect-metrics.mjs          | 100.00 |  95.65 |   ->  100.00 |  98.89
scripts/collect-radar-reports.mjs    | 100.00 |  97.50 |   ->  100.00 | 100.00
src files                            | 100.00 |  97.95 |   ->  100.00 |  98.26

1186 unit tests pass, 0 fail.

collect-metrics.mjs stops at 98.89% rather than 100% because of a seventh
region no test can reach: clone(url, destination, shallow = false) at
L156-160 is module-internal and both call sites (L22, L23) pass true, so the
: [] arm and the shallow = false default are dead code. Removing them is a
production-code change and is deliberately left out of this PR; it is recorded
under "Out of scope" on the issue.

Disjointness

This PR claims tests/helpers-script-sandbox.mjs plus the
collect-metrics / collect-radar-reports / collect-launch-metrics test
files. That is disjoint from every open hold-gated PR: #678 claims
tests/helpers-import-sandbox.mjs and import-architectures, #680 claims
svg-active-content, #686 claims fetch-community-people, #688 claims the
four validate-* test files, and #674 claims package.json.

Related Issue

Closes #692

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

[mrbobbytables]

Superseded by #750, which consolidates this and 14 other test-only coverage PRs into a single reviewable change (commit cherry-picked unmodified, authorship and DCO preserved).