fix(nodetoken): make the corrupt-ciphertext test corrupt deterministically (#6520)

* fix(nodetoken): make the corrupt-ciphertext test corrupt deterministically

The test replaced the last two characters of the base64 body with "AA", which
can decode to the very same bytes: the body is RawURLEncoding of a 31-byte
blob, so the final character carries only 2 significant bits and the decoded
value is unchanged whenever the tag's last byte is 0x00. Measured over 50000
encryptions, 170 of those edits corrupted nothing — about one run in three
hundred fails for a reason that has nothing to do with the codec.

Flipping a bit of the decoded blob always changes the ciphertext, so the test
now pins the fallback behavior instead of the encoder's tail padding.

* style(nodetoken): trim the helper comment to the two-line limit

CLAUDE.md caps a committed Go comment block at two lines; the why fits.

internal/crypto/nodetoken/nodetoken_test.go

@@ -96,7 +96,7 @@ func TestEncryptedNeverFallsBackToPlaintext(t *testing.T) {
 	c, _ := NewCodec(ModeRequired, testRing(t, "k1", "k1"))
 	enc, _ := c.Encrypt(1, "tok")
 	// Corrupt the ciphertext body — must error, never return raw bytes.
-	bad := enc[:len(enc)-2] + "AA"
+	bad := flipLastCiphertextBit(t, enc)
 	if _, err := c.Decrypt(1, bad); err == nil {
 		t.Fatal("corrupted ciphertext must fail, not fall back to plaintext")
 	}
@@ -108,6 +108,19 @@ func TestEncryptedNeverFallsBackToPlaintext(t *testing.T) {
 	}
 }
 
+// flipLastCiphertextBit rewrites the body through its decoded bytes, because
+// editing the trailing base64 characters can leave those bytes untouched.
+func flipLastCiphertextBit(t *testing.T, stored string) string {
+	t.Helper()
+	cut := strings.LastIndex(stored, ":") + 1
+	blob, err := base64.RawURLEncoding.DecodeString(stored[cut:])
+	if err != nil {
+		t.Fatalf("decode ciphertext body: %v", err)
+	}
+	blob[len(blob)-1] ^= 0x01
+	return stored[:cut] + base64.RawURLEncoding.EncodeToString(blob)
+}
+
 func TestEncryptionMarkerPassesThroughWhenDisabled(t *testing.T) {
 	c, _ := NewCodec(ModeOff, nil)
 	stored := "enc:v1:not-ciphertext"