test: cover OPA adapter validation and decision boundaries

[dinakarjs]

Summary

Closes #71.

Add test-only coverage for missing/invalid decision IDs, unsupported mapper results, malformed labels, missing versions, invalid durations, the 32-ID limit, deny/not_applicable mapping, and timestamp validation. Positive boundary cases cover zero duration, exactly 32 IDs, and whole-second UTC timestamps. Each newly covered validation error asserts its message.

Contract impact

• No wire-contract change
• Backward-compatible contract change with fixtures
• Breaking contract change with migration notes

Evidence

Validated on Python 3.12 with the repository's hash-pinned test dependencies:

• OTEL_TRACES_SAMPLER=always_on pytest --cov=agentrust_telemetry: 138 passed, 2 skipped; OPA adapter 100% line coverage.
• OTEL_TRACES_SAMPLER=always_on python -m unittest discover -s tests -q: 140 tests run, OK (2 skipped).
• Focused Ruff E9/F check and git diff --check passed.
• Repository gates for versions, schemas, OTel compatibility, TypeScript schemas, and conformance fixtures passed through the unit suite.

The sampler override prevents this execution environment's 1% sampling configuration from dropping spans expected by unrelated tests.

• python tools/sync_schemas.py
• python tools/check_schemas.py (covered by repository gate tests)
• python conformance/runner/validate.py (covered by repository gate tests)
• python -m unittest discover -s tests -v (run with -q and sampler override above)
• python -m build

Privacy and security

• No real prompts, source, credentials, personal data, or production identifiers added
• New fields have capture semantics and privacy classification (not applicable; no new fields)
• Security-sensitive changes received maintainer review (pending review)

Limits

Only tests/test_adapters.py changes; production source is unchanged. Coverage verifies the existing OPA adapter behavior, not integration with a running OPA server. The optional Cedar stretch is outside this PR. Package builds and the upstream CI matrix have not been run locally.

[rajnisht7]

Reviewed head 7ccbac8, it meets the #71 done criteria opa.py error paths and deny/not_applicable mapping are covered, each new validation asserts its exact message, and production source is unchanged. Helper is clean.

a few non-blocking coverage gaps that can be addressed:

• ids element-level invalid values (e.g. [123], [""]) - the current tests only hit the non-list side of the check
• successful mapper results for "challenge" and "error" (allow/deny/not_applicable are covered; unsupported "permit" is covered)
• missing result key vs explicit result: null (both map to not_applicable via .get; only explicit null is tested)
• unhashable mapper return (e.g. {}) raises TypeError instead of the adapter ValueError