ci: fail the build when a policy has no test or no empty-input test

[kmadan]

Why

CONTRIBUTING.md has always required a sibling test and an empty-input test per
policy. Nothing enforced it, and the gap reached 22 of 96 policies with no test
at all — including both Article 5 prohibited-practice policies, the two gating
the practices the EU AI Act bans outright.

An external reviewer demonstrated the consequence rather than asserting it. In
prohibited_practices/social_scoring.rego:

-default allow := false
+default allow := true

That turns the Article 5 social-scoring gate into a default allow, and
opa test still reported 604/604. Nothing went red.

Credit to @GeiserX, in
GeiserX/awesome-europe#40.

What this adds

scripts/check-test-coverage.sh, run in CI, reading the coverage data that CI
already keeps current. It fails if a non-library policy:

• has no sibling *_test.rego, or
• has one with no empty-input assertion.

Both are checked because they fail differently. No test file means nothing is
verified. A test file without an empty-input assertion usually means the
fail-open case specifically is unverified — and in Rego an undefined value is not
false, so a policy that reaches no conclusion returns no decision, which at a
gate reads as a policy that has quietly stopped saying no.

The seven libraries under global/v1/common/ and helper_functions/ are exempt:
they define helpers rather than decisions and have no allow to hand an empty
input to. That is is_library in the coverage data, derived from whether the file
declares decision rules.

This passes today — that is the point

Every policy has had a test since v1.3.0. The previous state was a snapshot that
one new file could silently undo, which is exactly how the gap opened in the first
place. Now it is a gate.

Verified by breaking it

Change	Result
mv social_scoring_test.rego away	exit 1, names the file
Replace with input as {} with a non-empty input	exit 1, names the missing empty-input assertion
Restored	exit 0, "All 91 policies have a test and an empty-input test (7 libraries exempt)"

Also worth recording: the reviewer's mutation no longer survives. On current
main, flipping default allow := false to true fails 4 tests in
social_scoring and 5 in emotion_recognition.

Docs corrections

This makes two claims false, and they are fixed here:

• docs/coverage/eu-ai-act.md told contributors "not every policy has a sibling
  *_test.rego" and asked for tests on untested files. All 98 have tests. The
  useful contribution now is a test for a case — a policy whose only test proves
  it denies an empty input is verified against the fail-open class and nothing
  else — and the text says that instead.
• docs/coverage/README.md said "most of them also assert that the policy denies
  an empty input". All of them do, and it is now enforced.