[test-improver] Improve tests for validateSingleAgentPolicy error paths (#12193)

## Summary
Improved `internal/config/agent_policy_test.go` by adding coverage for
previously-untested error branches in `validateSingleAgentPolicy`
(`internal/config/agent_policy.go`).

## File analyzed
`internal/config/agent_policy_test.go` (tests
`internal/config/agent_policy.go`)

## Improvements made
Added two new test functions:
- `TestValidateSingleAgentPolicy_ErrorPaths` — table-driven test
covering:
  - empty server entry (`Servers: []string{""}`)
  - unknown server reference
  - duplicate server entry
  - tools map referencing a server not in the policy's `Servers` list
  - empty tool entry
  - duplicate tool entry
  - invalid `AllowOnly` sub-policy (propagated validation error)
- `TestValidateSingleAgentPolicy_ValidPolicySucceeds` — a happy-path
sanity check that a fully valid policy returns no error.

All new tests use testify
(`require.Error`/`assert.ErrorContains`/`assert.NotContains`/`assert.NoError`),
consistent with the existing file's conventions, and assert that the raw
agent ID is never leaked into error messages (matching the existing
whitespace test's behavior).

## Coverage before/after
- `validateSingleAgentPolicy`: 87.5% → **100%**
- `internal/config` package total: 96.9% → 97.1%

## Test output
```
go test -run "TestValidateSingleAgentPolicy" -v ./internal/config/
--- PASS: TestValidateSingleAgentPolicy_RejectsSurroundingWhitespace (0.00s)
--- PASS: TestValidateSingleAgentPolicy_ErrorPaths (0.00s)
--- PASS: TestValidateSingleAgentPolicy_ValidPolicySucceeds (0.00s)
PASS
ok  	github.com/github/gh-aw-mcpg/internal/config	0.008s
```

Also verified:
- `go test -count=3 ./internal/config/...` — all pass (stability check)
- `go vet ./internal/config/` — clean
- `gofmt -l internal/config/agent_policy_test.go` — no output (already
formatted)

No existing tests were modified or removed; all changes are additive.

> Generated by [Test
Improver](https://github.com/github/gh-aw-mcpg/actions/runs/33342548419)
· copilot · auto · 133.9 AIC · ⊞ 8.6K ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+test-improver%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Test Improver, engine: copilot, model:
auto, id: 33342548419, workflow_id: test-improver, run:
https://github.com/github/gh-aw-mcpg/actions/runs/33342548419 -->

<!-- gh-aw-workflow-id: test-improver -->
<!-- gh-aw-workflow-call-id: github/gh-aw-mcpg/test-improver -->

Author: lpcox

internal/config/agent_policy_test.go

@@ -86,6 +86,90 @@ func TestValidateSingleAgentPolicy_RejectsSurroundingWhitespace(t *testing.T) {
 	}
 }
 
+// TestValidateSingleAgentPolicy_ErrorPaths covers the remaining validation
+// failure branches in validateSingleAgentPolicy that were previously
+// uncovered: empty server/tool entries and duplicate server/tool references.
+func TestValidateSingleAgentPolicy_ErrorPaths(t *testing.T) {
+	servers := map[string]*ServerConfig{"github": {}, "fetch": {}}
+
+	tests := []struct {
+		name        string
+		policy      *AgentPolicy
+		errContains string
+	}{
+		{
+			name:        "empty server entry",
+			policy:      &AgentPolicy{Servers: []string{""}},
+			errContains: "must be non-empty strings",
+		},
+		{
+			name:        "unknown server reference",
+			policy:      &AgentPolicy{Servers: []string{"unknown-server"}},
+			errContains: "references unknown server",
+		},
+		{
+			name:        "duplicate server entry",
+			policy:      &AgentPolicy{Servers: []string{"github", "github"}},
+			errContains: "must not contain duplicate server",
+		},
+		{
+			name: "tools reference server not in policy's servers list",
+			policy: &AgentPolicy{
+				Servers: []string{"github"},
+				Tools:   map[string][]string{"fetch": {"fetch_url"}},
+			},
+			errContains: "not in the policy's servers list",
+		},
+		{
+			name: "empty tool entry",
+			policy: &AgentPolicy{
+				Servers: []string{"github"},
+				Tools:   map[string][]string{"github": {""}},
+			},
+			errContains: "must be non-empty strings",
+		},
+		{
+			name: "duplicate tool entry",
+			policy: &AgentPolicy{
+				Servers: []string{"github"},
+				Tools:   map[string][]string{"github": {"search_code", "search_code"}},
+			},
+			errContains: "must not contain duplicate tool",
+		},
+		{
+			name: "invalid allow-only policy",
+			policy: &AgentPolicy{
+				Servers:   []string{"github"},
+				AllowOnly: &AllowOnlyPolicy{MinIntegrity: "not-a-real-level"},
+			},
+			errContains: "allow-only is invalid",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateSingleAgentPolicy("secret-agent-id", tt.policy, servers)
+			require.Error(t, err)
+			assert.ErrorContains(t, err, tt.errContains)
+			assert.NotContains(t, err.Error(), "secret-agent-id")
+		})
+	}
+}
+
+func TestValidateSingleAgentPolicy_ValidPolicySucceeds(t *testing.T) {
+	servers := map[string]*ServerConfig{"github": {}, "fetch": {}}
+	policy := &AgentPolicy{
+		Servers: []string{"github", "fetch"},
+		Tools: map[string][]string{
+			"github": {"search_code", "get_file_contents"},
+			"fetch":  {"*"},
+		},
+	}
+
+	err := validateSingleAgentPolicy("agent-1", policy, servers)
+	assert.NoError(t, err)
+}
+
 // --- Config accessor tests ---
 
 func TestConfig_AgentPolicyAccessors(t *testing.T) {