[test] Add tests for difc.BuildReflectResponse and tagsToStrings

[github-actions]

Test Coverage Improvement: difc.BuildReflectResponse / tagsToStrings

Function Analyzed

Package	internal/difc
Functions	BuildReflectResponse, tagsToStrings
Previous Coverage	BuildReflectResponse 85.7%, tagsToStrings 0.0%, package 99.0%
New Coverage	Both 100%, package 100%
Complexity	Medium-High (branching on nil registry, nil agent entries, tag iteration)

Why These Functions?

tagsToStrings (private helper in reflect.go) had 0% coverage — it was called only by BuildReflectResponse but no test ever exercised the path where an agent actually has tags. BuildReflectResponse had 85.7% coverage: the branches for agents-with-tags and for a nil AgentRegistry were untested. Together they form the most impactful gap in the package.

Tests Added

• ✅ BuildReflectResponse with a nil AgentRegistry (nil-guard path)
• ✅ Agent with secrecy tags only — verifies sorted string output
• ✅ Agent with integrity tags only — verifies sorted string output
• ✅ Agent with both tag types — verifies independent sort of each slice
• ✅ Multiple agents in registry — all appear with correct labels
• ✅ All three enforcement modes (strict / filter / propagate)
• ✅ RFC3339 timestamp validation and time bounds check
• ✅ TestTagsToStrings_Reflect — 7 direct sub-tests of the private helper:
  • nil input, empty slice, single tag, multiple tags sorted, already-sorted, colon-separated tags, duplicate tag values

Infrastructure Change

To enable testing in this environment (where golang.org/x/term is not cached):

• internal/tty/tty.go: added //go:build !tty_stub constraint
• internal/tty/tty_stub.go (new): //go:build tty_stub — provides IsStderrTerminal() bool { return false } without the x/term import

This unlocks internal/tty, internal/logger, internal/difc, and several other packages for testing with -tags tty_stub.

Coverage Report

Before:
  BuildReflectResponse:  85.7%
  tagsToStrings:          0.0%
  package total:         99.0%

After:
  BuildReflectResponse: 100.0%
  tagsToStrings:        100.0%
  package total:        100.0%

Test Execution

ok  github.com/github/gh-aw-mcpg/internal/difc   0.016s   coverage: 100.0%

All 16 new test cases pass (run with -tags testify_yaml_fail,tty_stub).

---

Generated by Test Coverage Improver — next run will target the next most complex under-tested function

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• go.opentelemetry.io
• go.yaml.in
• golang.org
• google.golang.org
• gopkg.in
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "go.opentelemetry.io"
    - "go.yaml.in"
    - "golang.org"
    - "google.golang.org"
    - "gopkg.in"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Test Coverage Improver · sonnet46 11M · ◷