test: cover setProjectPM save failure, deleteAlias save failure, hooks async/timeout validation

Round 72: Add 4 tests for untested code paths (818 → 822):
- package-manager.js: setProjectPackageManager wraps writeFile errors (lines 275-279)
- session-aliases.js: deleteAlias returns failure when saveAliases fails (line 299)
- validate-hooks.js: rejects non-boolean async field (line 28-31)
- validate-hooks.js: rejects negative timeout value (lines 32-35)

tests/lib/package-manager.test.js

@@ -1306,6 +1306,31 @@ function runTests() {
     }
   })) passed++; else failed++;
 
+  // ── Round 72: setProjectPackageManager save failure wraps error ──
+  console.log('\nRound 72: setProjectPackageManager (save failure):');
+
+  if (test('setProjectPackageManager throws wrapped error when write fails', () => {
+    if (process.platform === 'win32' || process.getuid?.() === 0) {
+      console.log('    (skipped — chmod ineffective on Windows/root)');
+      return;
+    }
+    const isoProject = path.join(os.tmpdir(), `ecc-pm-proj-r72-${Date.now()}`);
+    const claudeDir = path.join(isoProject, '.claude');
+    fs.mkdirSync(claudeDir, { recursive: true });
+
+    // Make .claude directory read-only — can't create new files
+    fs.chmodSync(claudeDir, 0o555);
+
+    try {
+      assert.throws(() => {
+        pm.setProjectPackageManager('npm', isoProject);
+      }, /Failed to save package manager config/);
+    } finally {
+      fs.chmodSync(claudeDir, 0o755);
+      fs.rmSync(isoProject, { recursive: true, force: true });
+    }
+  })) passed++; else failed++;
+
   // Summary
   console.log('\n=== Test Results ===');
   console.log(`Passed: ${passed}`);