test: close remaining coverage gaps to 100% on application source + s…

[man4ish]

…cripts

Application-source line coverage (api/, audit/, consumers/, db/, schemas/, services/, worker/, scripts/ -- excluding tests/ itself, which trivially self-covers and shouldn't count toward the metric, per commit 4d27381) was 84% (234 lines missing out of 1465), driven almost entirely by scripts/ -- audit_retention_cleanup.py (27%), verify_audit_integrity.py (26%), and provision_audit_db_users.py (0%) had never been brought up to the bar the rest of the codebase holds, since they were added after that earlier 100% milestone.

• audit/record_integrity.py: canonical_json's non-JSON-string fallback branch, and both verify*_hash functions' fail-closed except Exception wrapper (via a value whose format raises)
• consumers/quarantine.py: new tests/test_quarantine.py -- classify_poison_reason's well-formed-JSON-object branches and QuarantineSink.write's idempotent-duplicate (IntegrityError -> rollback) path
• services/audit_health_service.py: XINFO CONSUMERS failure degrading only consumer stats, and _int_env's malformed-value except branch
• scripts/redis_acl_safety.py: RedisEnvironment's repr/eq/hash, DisposableAttestation.generate_nonce, gate construction against an UNKNOWN (not just unreachable) environment, AuthenticatedSession's double-close/context-manager/best-effort-cleanup behavior, and authenticate()'s own error-conversion branches -- mocked redis.Redis is used only for this generic control-flow plumbing, never in place of the real-Docker-Redis tests that prove actual AUTH/ACL semantics
• scripts/verify_audit_integrity.py: new tests/test_verify_audit_integrity.py -- _resolve_secret/_resolve_session, verify_audit_events/ verify_quarantine_records (valid/tampered/no-baseline/structural/ duplicate-id cases), _report, _write_status_file, main()'s full pass/fail/exception-safety flow, and the main guard
• scripts/audit_retention_cleanup.py: new tests/test_audit_retention_cleanup.py -- _count_eligible/_delete_eligible against a real SQLite engine (legal-hold exclusion proven end to end), _write_status_file, and main()'s dry-run/execute/partial-result/failed-table/status-file paths
• scripts/provision_audit_db_users.py: new tests/test_provision_audit_db_users.py -- _required_env, _connect_admin's URL parsing, _create_user_and_grants' per-table GRANT issuance (and that audit_writer/audit_reader never get a DELETE grant), and main()'s full provisioning + cleanup-on- exception flow, all against a mocked pymysql.connect

574 tests pass (up from 495); ruff check is clean on every file touched here.