tests: lift gateway coverage 74.1% -> 96.8%

[TeoSlayer]

Summary

• Adds zz_coverage_test.go covering previously-untested branches of gateway.go and service.go
• Per-function coverage rose from 74.1% to 96.8% (race + 180s timeout, all green)
• All previously-zero functions (Map, startProxy, addLoopbackAlias, Service.{New,Name,Order,Start,Stop}) are now at 100%

What is covered

• New: invalid-subnet error path + default subnet/ports
• Map: happy path (auto + explicit IP) via startProxy under stubbed ip/ifconfig on PATH; invalid-IP + outside-subnet errors
• Unmap: real listener teardown + alias removal; malformed host:port listener keys are skipped without panic
• Stop: idempotent re-Stop, nil-dialer safety, alias slice cleanup, dialer.Close error tolerated
• addLoopbackAlias / removeLoopbackAlias: both success (rc=0) and failure (rc=1) exec paths via PATH-shadowed POSIX stubs. Guarded with os.Getuid() != 0 and runtime.GOOS in {linux,darwin} so the tests never touch the real loopback table and skip cleanly on Windows.
• bridgeConnection: pilot-side read-error branch (peer close triggers symmetric teardown)
• listenPort: full bind / accept / Stop lifecycle
• Service (L11 plugin adapter): NewService, Name, Order, Start, Stop

Ceiling

Remaining ~3.2% is the linux-vs-darwin switch legs in add/removeLoopbackAlias (mutually exclusive at runtime on a given host) plus the default unsupported-OS arm (unreachable without crossbuild). Per-function the only sub-100% items are those two alias helpers, both at 62.5% — that's the structural ceiling on this host.

Test plan

• go test -race -count=1 -timeout 180s ./... passes
• Coverage report verified via go tool cover -func and -html
• No new files outside *_test.go
• All shell-out tests guarded so they never run as root and never execute on non-linux/darwin

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️