test: cover run_certification in aprender-qa-cli/src/certification.rs #5690

Test-only ticket, estimated <=200 lines of test. Source: pmat query --coverage-gaps --rank-by impact --exclude-tests on coverage-nightly run 39080471983 (sha e6ab79f; CI runner paths rewritten to this checkout).

Function: run_certification in crates/aprender-qa-cli/src/certification.rs. Write tests that assert behaviour (not just no-panic) so the uncovered branches run; per the coverage+contracts rule add or strengthen the matching falsification line in the contract YAML and run pv validate. No unwrap, no new Python.
Falsifier (write FIRST): a test asserting a specific output of run_certification per uncovered branch, shown failing when that branch is deleted or inverted, then passing.
Before starting: confirm on origin/main the function is still uncovered (pmat query "run_certification" --coverage --uncovered-only) and that no branch or open PR carries this ticket's number.
Done when: the function's uncovered lines are executed by tests in cargo test -p <crate> --lib and the contract line is in.