fix(opa): reject unhashable mapper decisions

[1cbyc]

Summary

Validate an OPA result mapper return type before checking supported decision values, so dictionaries and lists receive the same adapter ValueError as unsupported strings.

Fixes #75.

Contract impact

• No wire-contract change
• Backward-compatible contract change with fixtures
• Breaking contract change with migration notes

Evidence

• python tools/check_schemas.py
• python conformance/runner/validate.py
• python -m unittest discover -s tests -v
• python -m build
• wheel and sdist smoke tests
• TypeScript npm run check

The Python suite passes 142 tests with two optional PyYAML skips. The TypeScript suite passes 44 tests.

Privacy and security

• No real prompts, source, credentials, personal data, or production identifiers added
• New fields have capture semantics and privacy classification
• Security-sensitive changes received maintainer review

Limits

This only normalizes invalid result mapper return values; it does not change valid OPA decision mapping or the wire contract.

Co-authored-by: insisong emmanuelisaacnsisong@gmail.com

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.