[H4] Thin test coverage on the core decision logic

[lelu-auth]

~24 _test.go files for ~17k LOC. The most safety-critical path — the most-restrictive layer merge in evaluateAgentDecision — is lightly covered.

Location: engine-wide; focus on engine/internal/server/server.go decision merge.

Fix: Add table-driven tests covering confidence × policy × risk outcome combinations and the merge precedence.