rees-coverage.mjs's bare catch{} can mask a real lcov write failure as "report missing"

[JSONbored]

Context

scripts/rees-coverage.mjs:49-56:

try {
  const raw = readFileSync(lcovPath, "utf8");
  writeFileSync(lcovPath, raw.replace(/^SF:(.*)$/gm, (_m, path) => `SF:${String(path).replace(/\\/g, "/")}`));
} catch {
  // CI's "Verify REES coverage report exists" step fails closed if the report is missing.
}

The comment's rationale only covers the "report doesn't exist yet" case (readFileSync throwing ENOENT), but the catch also swallows a writeFileSync failure (disk full, permissions, etc.) on a report that does exist — in that case the downstream "report exists" check would still pass (the file is there, just not path-normalized), so Codecov would silently ingest un-normalized SF: paths with no CI signal at all.

Requirements

Narrow the catch to only swallow the specific readFileSync ENOENT case (e.g. check error.code === "ENOENT" and re-throw otherwise), so a genuine writeFileSync failure on an existing report surfaces as a real CI failure instead of being silently absorbed.

Deliverables

• The catch block in scripts/rees-coverage.mjs only swallows ENOENT from the initial read; any other error (including a write failure) propagates and fails the script.
• A regression test covering both the legitimate "file doesn't exist yet" pass-through and a simulated write failure now surfacing as an error.

Test Coverage Requirements

scripts/rees-coverage.mjs currently has zero test coverage — add tests for both cases above.

Expected Outcome

A real lcov write failure during REES coverage post-processing is surfaced as a CI failure instead of silently letting un-normalized paths reach Codecov.

Links & Resources

scripts/rees-coverage.mjs:49-56

[linear-code]

JSO-5455