The old test used "0"+sig[1:] to corrupt the signature. If the real HMAC
starts with "0", the corruption is a no-op and the test fails non-deterministically.
Replace with a fixed 64-char hex constant that is never a valid HMAC output.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>