Add full-coverage tests for rules-guard

[rblaine95]

Summary

Brings the rules-guard extension test suite to 100% function and line coverage across positive, negative, adversarial, and fuzzy cases, and enforces it with coverageThreshold = 1.0 in bunfig.toml so any regression fails bun test.

Test count: 20 → 55, all passing.

What changed

• extensions/rules-guard/index.test.ts — new suites:
  • Positive / negative for every export: compileGlob, bashMatcher, parseRule, candidateAbsPaths, pathTokens, redactText, loadPolicyEntries, plus the rulesGuard wiring hooks (registration, session_start, tool_call, tool_result) via a minimal ExtensionAPI mock.
  • Adversarial bypass vectors: path traversal (..) that resolves into a denied directory, denied commands hidden after shell separators (;, &&, ||, |, newline), and a read-class deny binding write/edit/unknown tools.
  • Fuzzy invariants, seeded with mulberry32 for determinism under the coverage gate: decide never throws, compileGlob output stays anchored, redactText is idempotent, and any leaf under a denied directory is always blocked.
• bunfig.toml — coverageThreshold = 1.0.
• extensions/rules-guard/index.ts — embedded deny rule for RSA private key files (Read(**/*.id_rsa)).
• hk.pkl — exclude the test suite from the detect_private_key pre-commit hook; the suite embeds a synthetic PEM fixture purely to exercise secret redaction, which otherwise trips the scanner.

Verification

• bun test — 55 pass, 0 fail, 100.00% funcs / 100.00% lines, exit 0.
• bun typecheck — clean.
• bunx biome check — clean.
• Pre-commit hk hooks pass (including detect_private_key with the scoped exclusion).