test: add comprehensive coverage for TOCTOU fix error paths

[Copilot]

The TOCTOU fix in PR #766 introduced error handling branches that reduced ssl-bump.ts branch coverage from 100% to 81.25%, failing the coverage regression check.

Changes

• Added tests for EEXIST error handling (file already exists - should be silently caught)
• Added tests for non-EEXIST errors (permission denied, etc. - should be re-thrown)
• Added test for non-Error throws in generateSessionCa (string rejection handling)
• Fixed ESLint rule name: prefer-promise-reject-with-error → @typescript-eslint/prefer-promise-reject-errors

Coverage

• ssl-bump.ts: 81.25% → 100% branch coverage
• 5 new tests added (753 total, all passing)

The tests use filesystem permissions to trigger realistic error conditions:

// Test EEXIST handling (graceful)
await initSslDb(tempDir);  // Creates files
await initSslDb(tempDir);  // Succeeds silently on EEXIST

// Test non-EEXIST error re-throw
fs.chmodSync(sslDbPath, 0o500);  // Read-only
await expect(initSslDb(tempDir)).rejects.toThrow();  // EACCES propagates

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Mossaka]

Closing PR in favor of tracking issue #837.