[quality] test uncovered pure-logic guard clauses and project-file write paths

[danathar-atomic-hive]

Test Improvement

Adds 8 unit tests in tests/test_atomic_image_builder.py closing 9 of the 68 lines in atomic_image_builder.py flagged in #51 as uncovered by both the unit and e2e suites:

• read_os_release_fields() missing-file OSError branch and blank/comment/keyless-line skip (lines 175-176, 181)
• pin_action_uses_line()'s no-pin-recorded-for-this-action branch (line 528)
• ensure_workflow_job_env_entries()'s no-env/steps-anchor fallback (line 754)
• write_installer_configs()'s bundled-template-snapshot fallback read, as distinct from the already-tested raise branch (line 4352)
• write_bluebuild_project_files()'s cosign.pub write, previously only covered for the Containerfile-method equivalent (line 4453)
• write_container_project_files()'s from-scratch workflow generation, since every other include_workflow=True test pre-seeds the workflow via clone_container_template() first (line 4525)
• generate_readme()'s carried-scan-customizations branch (line 4784)

Verified with the repo's own coverage + unittest combo (python3 -m coverage run -m unittest discover -s tests, combined with the coverage-e2e artifact from CI run 33010925588 / commit 2a4f226 per .coveragerc.e2e): combined "neither suite" misses on atomic_image_builder.py drop from 68 to 59 lines, matching exactly the 9 lines above. All 617 tests pass (609 existing + 8 new), no regressions. ruff check passes.

Disjoint from open PR atomic-image-builder#54 (test uncovered Gum/App guard-clause branches), which targets a different subset of the same #51 list (lines 1247, 1274, 1443, 1670, 3241, 3489-3490) — none of those lines are touched here. This PR's files/functions: read_os_release_fields, pin_action_uses_line, ensure_workflow_job_env_entries, write_installer_configs, write_bluebuild_project_files, write_container_project_files, generate_readme — all outside PR #54's Gum/App guard-clause cluster.

Does not close #51 — 59 of the originally-flagged 68 lines remain (minus whichever of PR #54's 7 also land), still concentrated in the Gum UI plumbing (802-966), GitHub CLI wrapper (1251-1257, 2410, 2434-2438, 2677, 3346-3352), and remaining menu/flow guard-clause (1180, 1592-1595, 2546, 2957, 3208, 3286, 3359, 3401) clusters, which need subprocess/gh mocking this pass did not attempt. patch_bluebuild_action_inputs's inner patch_step([]) guard (line 4211) also remains: it is unreachable through the public API since its only caller (patch_workflow_steps's flush_step) never invokes the callback with an empty chunk, so it is defensive dead code rather than a real gap.

Related Issue

Refs #51 (partial — chips away at the remaining unit-coverage gap; does not fully resolve it)

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=claude model=claude-sonnet-5 claude=2.1.226