fix: reject empty coverage counters

tests/unit/risk-coverage-files.test.ts

@@ -131,6 +131,36 @@ describe("risk coverage CLI files", () => {
     ).rejects.toThrow(/changed during validation/u);
   });
 
+  it("fails closed when an opened input has no stable file identity", async () => {
+    const repositoryRoot = await fixture();
+    await expect(
+      readRiskCoverageInput(
+        {
+          repositoryRoot,
+          relativePath: "config/testing/policy.json",
+          label: "policy",
+        },
+        {
+          openFile: async (target, flags) => {
+            const handle = await open(target, flags);
+            return {
+              stat: async () => {
+                const metadata = await handle.stat();
+                Object.defineProperties(metadata, {
+                  dev: { value: 0 },
+                  ino: { value: 0 },
+                });
+                return metadata;
+              },
+              readFile: async (encoding) => handle.readFile(encoding),
+              close: async () => handle.close(),
+            };
+          },
+        },
+      ),
+    ).rejects.toThrow(/stable file identity unavailable/u);
+  });
+
   it("confines artifact output and rejects input overwrite or symlink ancestors", async () => {
     const repositoryRoot = await fixture();
     await expect(