Fix CI failures: PHPStan, tests, and CS fixer after recent guards

- Use strict base64_decode() in RenewalInfo::spkiDer() so PHPStan types it string|false
- Initialise $isPublic = false before .pem block in FilesystemStorage (PHPStan)
- Catch CryptoException from sans() in StatusCommand, fall back to []
- Update CertificateBundleDataTest to expect AcmeException on no-PEM response
- Add blank line before throw in ShellDns01Handler (CS fixer)

Author: bashgeek

src/Challenge/Dns/ShellDns01Handler.php

@@ -90,6 +90,7 @@ protected function run(string $cmdTemplate, string $domain, string $keyAuth): vo
 
         if ($exitCode !== 0) {
             $detail = $stderr !== '' ? ' — ' . $stderr : '';
+
             throw new ChallengeException(
                 sprintf('ShellDns01Handler: "%s" exited with code %d.%s', $cmdTemplate, $exitCode, $detail),
             );

src/Console/Command/StatusCommand.php

@@ -96,7 +96,11 @@ private function renderStatus(StoredCertificate $cert, string $storagePath): voi
         $expiresStr     = sprintf('%s (%d days remaining)', $expiresDate, $days);
         $issuedDate     = $cert->issuedAt->format('M j, Y');
         $identifiersStr = implode(', ', $cert->domains);
-        $sans           = $cert->sans();
+        try {
+            $sans = $cert->sans();
+        } catch (\CoyoteCert\Exceptions\CryptoException) {
+            $sans = [];
+        }
         $sansStr        = empty($sans) ? $identifiersStr : implode(', ', $sans);
         $keyLabel       = match ($cert->keyType) {
             KeyType::EC_P256  => 'EC P-256',

src/Endpoints/RenewalInfo.php

@@ -75,7 +75,7 @@ private function spkiDer(\OpenSSLAsymmetricKey $publicKey): string
         $decoded = base64_decode(implode('', array_map(
             'trim',
             array_filter(explode("\n", $pem), static fn(string $l): bool => !str_starts_with($l, '-----')),
-        )));
+        )), true);
 
         if ($decoded === false) {
             throw new CryptoException('Failed to decode issuer public key DER.');

src/Storage/FilesystemStorage.php

@@ -195,6 +195,8 @@ private function writeFile(string $path, string $contents): void
             );
         }
 
+        $isPublic = false;
+
         if (str_ends_with($path, '.pem')) {
             $isPublic = str_ends_with($path, 'certificate.pem')
                      || str_ends_with($path, 'fullchain.pem')

tests/Unit/DTO/CertificateBundleDataTest.php

@@ -29,13 +29,11 @@
     expect($bundle->caBundle)->not->toContain($certA);
 });
 
-it('returns empty strings when no certificate is found', function () {
-    $r      = new Response([], '', 200, 'no cert here');
-    $bundle = CertificateBundleData::fromResponse($r);
+it('throws when no certificate is found in the response', function () {
+    $r = new Response([], '', 200, 'no cert here');
 
-    expect($bundle->certificate)->toBe('');
-    expect($bundle->fullchain)->toBe('');
-    expect($bundle->caBundle)->toBe('');
+    expect(fn() => CertificateBundleData::fromResponse($r))
+        ->toThrow(\CoyoteCert\Exceptions\AcmeException::class);
 });
 
 it('is readonly — properties cannot be changed', function () use ($certA) {