test: cover transfer eligibility; credit cross-package coverage

[patramsey]

Two changes, both driven by looking at where coverage was rather than at the aggregate.

1. -coverpkg=./... — the per-file numbers were wrong

go test credits coverage only to the package under test, so code exercised from another package's tests counts for nothing. That made several files look untested when they're among the best-covered in the repo:

File	Reported	Actual
cmd/cmdutil/cmdutil.go	0%	85%
cmd/cmdutil/errors.go	17%	78%
cmd/cmdutil/confirm.go	42%	83%
internal/output/output.go	30%	59%
internal/api/client.go	70%	93%

Every one is called constantly by the command tests.

This isn't about the badge — the aggregate only moves 63.6% → 66.7%. It's that cmdutil.go 0% would send the next person to write tests that already exist. I nearly did exactly that before checking.

Cost: ~9% on the test job (21.0s → 22.9s measured locally with -race).

2. runEligibility was at 0.0%

The whole command was untested. It's what someone runs before committing to a transfer, and its entire job is telling them which command to run next — so a wrong recommendation sends them to a call that can't succeed.

Ten cases, 0.0% → 95.2% (transfer.go 58.4% → 64.9%):

• Request reaches /core/v1/transfers/eligibility/{domain}, domain canonicalized (EXAMPLE.COM → example.com)
• atName=false → recommends transfer create, never mentions internal-in
• atName=true → recommends transfer internal-in with the "requires enterprise reseller approval" caveat. Without it, ordinary users get sent to a call that 403s for everyone outside the allowlist — the exact regression the caveat was added for
• atName=true + supportsInternalTransfer=false → still internal-in, pinning that the TLD-level flag doesn't flip the recommendation on its own
• JSON and YAML carry the fields and omit the human hint, which wouldn't be valid alongside the document
• A 404 surfaces the API's message rather than a bare status

Verification

Mutation-tested, not just passing. Two mutations, both caught:

Mutation	Result
Invert if result.AtName	✅ caught
Delete the approval caveat	✅ caught

So the assertions fail for the reason they claim, rather than passing incidentally.

• golangci-lint run — no issues
• go test -race -count=1 ./... — full suite clean
• go vet ./... clean

What's next, if you want it

From the corrected profile, the remaining gaps in priority order: cmd/domain/requirements.go (26%, TLD registration rules), then a mechanical error-path sweep across cmd/dns, cmd/url, cmd/email (~66–71% each, same shape of gap). cmd/help.go, cmd/cmdutil/complete.go, and internal/update are all 0% but are help text, shell completion, and a network version check — number-movement rather than confidence, worth deciding on deliberately.

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️