fix: prevent flaky "throws on tampered ciphertext" test

The test replaced base64 char at position 30 with 'X', but if the
random nonce already produced 'X' at that position, the string was
unchanged and decrypt succeeded (~1.6% flake rate). Now picks a
replacement character guaranteed to differ from the original.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: shrijayan

packages/cli/src/__tests__/crypto.test.ts

@@ -94,8 +94,11 @@ describe("encrypt / decrypt", () => {
 
   it("throws on tampered ciphertext", () => {
     const ciphertext = encrypt("secret", key);
-    // Flip a character in the middle of the ciphertext
-    const tampered = ciphertext.slice(0, 30) + "X" + ciphertext.slice(31);
+    // Flip a character in the middle — ensure it actually changes
+    const pos = 30;
+    const replacement = ciphertext[pos] === "X" ? "Y" : "X";
+    const tampered =
+      ciphertext.slice(0, pos) + replacement + ciphertext.slice(pos + 1);
     expect(() => decrypt(tampered, key)).toThrow();
   });
 });