test: coverage for migrate gap branches (dotenv-only finalize, positional-arg die, already-v2 finalize, strict marker parse)

Coverage audit found 4 untested branches (all single-test fills): finalize on
a v1 dotenv/file-only store (v1count==0 stamp path — a real user scenario),
the migrate positional-arg die, finalize on an already-v2 store, and the
_store_format strict-parse defense (garbage marker reads as v1). Full suite 235/235.

test/migrate.bats

@@ -268,3 +268,40 @@ m_file_src()   { mkdir -p "$HOME/keystores"; printf 'KS\x00\x01\x02\xffDATA\n' >
   [ "$status" -eq 0 ]
   grep -q '^beaconClerkPkTest=pk_test_abc$' "$HOME/.gradle/gradle.properties"
 }
+
+@test "finalize on a v1 dotenv-only store stamps the marker (no v1 blobs to drop)" {
+  make_v1_store
+  create_project_dir dotenvfin
+  "$SECRETS_BIN" push dotenvfin >/dev/null 2>&1
+  # no gradle-properties externals → v1count==0 path; no confirmation needed
+  run "$SECRETS_BIN" migrate --finalize
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"no v1 blobs"* ]] || false
+  [ "$(cat "$SECRETS_DIR/.secrets-format")" = "2" ]
+}
+
+@test "migrate with a positional argument dies" {
+  init_with_remote
+  create_project_dir mgpos
+  run "$SECRETS_BIN" migrate someproject
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"no project argument"* ]] || false
+}
+
+@test "finalize on an already-v2 store is a no-op" {
+  init_with_remote
+  create_project_dir finv2
+  run "$SECRETS_BIN" migrate --finalize --yes
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"already format v2"* ]] || false
+}
+
+@test "_store_format reads a garbage marker as v1 (strict parse)" {
+  make_v1_store
+  create_project_dir garbagemarker
+  # a non-"2" marker (e.g. a truncated/garbled value) must read as v1, not v2
+  printf 'v2-ish-garbage\n' > "$SECRETS_DIR/.secrets-format"
+  run "$SECRETS_BIN" which
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"format: v1"* ]] || false
+}