test-only: extends the 2FA lockout dogfood cover (#3624 follow-up). No package changes, nothing to release.