Deduplicate canonical guard-policy missing-key error message

[Copilot]

The guard-policy validation path duplicated the same missing-key error string in three places (UnmarshalJSON, ValidateGuardPolicy, NormalizeGuardPolicy). This centralizes that message into one canonical constant to prevent drift across validation and parsing paths.

• Error message canonicalization

  • Added errMsgPolicyMissingKey in internal/config/guard_policy_validation.go as the single source of truth for:
    • "policy must include allow-only or write-sink"

• Callsite updates

  • Replaced duplicated literals at all three sites:
    • internal/config/guard_policy.go (GuardPolicy.UnmarshalJSON)
    • internal/config/guard_policy_validation.go (ValidateGuardPolicy, NormalizeGuardPolicy)
  • Switched these returns to errors.New(errMsgPolicyMissingKey) for direct constant-backed errors.

• Test alignment

  • Updated targeted assertions in internal/config/guard_policy_test.go to reference the canonical constant for the missing-key path, reducing brittle string duplication in tests.

const errMsgPolicyMissingKey = "policy must include allow-only or write-sink"

if policy == nil || (policy.AllowOnly == nil && policy.WriteSink == nil) {
    return nil, errors.New(errMsgPolicyMissingKey)
}

[Copilot]

Pull request overview

This PR centralizes the guard-policy “missing key” error message into a single constant so the parsing (UnmarshalJSON) and validation/normalization paths can’t drift on wording.

Changes:

• Added errMsgPolicyMissingKey constant in internal/config/guard_policy_validation.go.
• Replaced duplicated missing-key error literals in GuardPolicy.UnmarshalJSON, ValidateGuardPolicy, and NormalizeGuardPolicy with errors.New(errMsgPolicyMissingKey).
• Updated select tests to reference the canonical constant instead of duplicating the string.

Show a summary per file

File	Description
internal/config/guard_policy.go	Switches the missing-key JSON unmarshal error to use the canonical constant.
internal/config/guard_policy_validation.go	Introduces the canonical error message constant and updates validation/normalization callsites to use it.
internal/config/guard_policy_test.go	Aligns some test assertions with the canonical missing-key constant.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 2

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in a786d1a.

• Updated remaining TestNormalizeGuardPolicy missing-key assertions to use errMsgPolicyMissingKey.
• Renamed the {} unmarshal test case to missing allow-only and write-sink fields for clarity.
• Re-ran targeted guard-policy tests and full make agent-finished validation.