fix(startup): fail closed on key inspection errors

Propagate database inspection failures instead of treating them as
missing encrypted credentials.

This keeps startup from generating a fresh encryption key when an
existing database cannot be inspected and adds a regression test for
that path.

scripts/bootstrap-env.mjs

@@ -87,8 +87,9 @@ function hasEncryptedCredentials(dataDir) {
     } finally {
       db.close();
     }
-  } catch {
-    return false;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Unable to inspect existing database at ${dbPath}: ${message}`);
   }
 }