The fake IAM answered /api/get-users while LookupByAttribute has sent
/v1/iam/get-users for some time, so the case was unreachable. The test still
passed — the caller treats a lookup error as 'no match' — which is why the
drift went unnoticed. Instrumenting the branch confirms it is still not
exercised by any test here; that gap is pre-existing and worth its own test.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>