[test-improver] Improve tests for server hasServerGuardPolicies (#3273)

## Test Improvements: `has_server_guard_policies_test.go`

## File Analyzed

- **Test File**: `internal/server/has_server_guard_policies_test.go`
- **Package**: `internal/server`
- **Lines of Code**: 65 → 126 (added 5 new test cases)

## Improvements Made

### 1. Increased Coverage

The function `hasServerGuardPolicies` iterates `cfg.Servers` and returns
`true` on the first server that has a non-empty `GuardPolicies` map, or
`false` if none do. The original 3 tests only verified the single-server
happy path. New test cases exercise the multi-server iteration logic and
boundary conditions:

- ✅ Added: **Empty Servers map** (no servers configured → `false`)
- ✅ Added: **Multiple servers all without guard policies** (full
iteration, all misses → `false`)
- ✅ Added: **Multiple servers where only one has guard policies** (early
return on match → `true`)
- ✅ Added: **Multiple servers all with guard policies** (immediate early
return → `true`)
- ✅ Added: **Mix of servers with/without empty guard-policies maps**
(confirms `{}` counts as absent → `false`)

### 2. Cleaner Test Structure

- ✅ Extracted shared `allowOnlyPolicy` fixture to reduce duplication
across test cases
- ✅ Renamed test cases to follow the `<scenario> returns <result>`
naming convention, making failures self-documenting
- ✅ Removed redundant custom failure message from `assert.Equal`
(testify already provides clear diffs)

## Why These Changes?

`hasServerGuardPolicies` is used during DIFC auto-detection to decide
whether guard enforcement should be enabled. The original 3 tests only
covered single-server scenarios, leaving the multi-server iteration and
early-return paths entirely untested. Since map iteration order in Go is
non-deterministic, the multi-server tests confirm the function is
correct regardless of which server is visited first.

---
*Generated by Test Improver Workflow*
*Focuses on better patterns, increased coverage, and more stable tests*




> Generated by [Test
Improver](https://github.com/github/gh-aw-mcpg/actions/runs/24030278829/agentic_workflow)
· ● 4.4M ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+test-improver%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Test Improver, engine: copilot, model:
auto, id: 24030278829, workflow_id: test-improver, run:
https://github.com/github/gh-aw-mcpg/actions/runs/24030278829 -->

<!-- gh-aw-workflow-id: test-improver -->

Author: lpcox

internal/server/has_server_guard_policies_test.go

@@ -8,30 +8,32 @@ import (
 )
 
 func TestHasServerGuardPolicies(t *testing.T) {
+	allowOnlyPolicy := map[string]interface{}{
+		"allow-only": map[string]interface{}{
+			"min-integrity": "approved",
+			"repos":         []interface{}{"github/gh-aw*"},
+		},
+	}
+
 	tests := []struct {
 		name     string
 		cfg      *config.Config
 		expected bool
 	}{
 		{
-			name: "server with guard-policies should return true",
+			name: "single server with guard-policies returns true",
 			cfg: &config.Config{
 				Servers: map[string]*config.ServerConfig{
 					"github": {
-						Type: "stdio",
-						GuardPolicies: map[string]interface{}{
-							"allow-only": map[string]interface{}{
-								"min-integrity": "approved",
-								"repos":         []interface{}{"github/gh-aw*"},
-							},
-						},
+						Type:          "stdio",
+						GuardPolicies: allowOnlyPolicy,
 					},
 				},
 			},
 			expected: true,
 		},
 		{
-			name: "server without guard-policies should return false",
+			name: "single server without guard-policies returns false",
 			cfg: &config.Config{
 				Servers: map[string]*config.ServerConfig{
 					"github": {
@@ -42,10 +44,70 @@ func TestHasServerGuardPolicies(t *testing.T) {
 			expected: false,
 		},
 		{
-			name: "server with empty guard-policies should return false",
+			name: "single server with empty guard-policies map returns false",
+			cfg: &config.Config{
+				Servers: map[string]*config.ServerConfig{
+					"github": {
+						Type:          "stdio",
+						GuardPolicies: map[string]interface{}{},
+					},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "no servers returns false",
+			cfg: &config.Config{
+				Servers: map[string]*config.ServerConfig{},
+			},
+			expected: false,
+		},
+		{
+			name: "multiple servers all without guard-policies returns false",
+			cfg: &config.Config{
+				Servers: map[string]*config.ServerConfig{
+					"github": {Type: "stdio"},
+					"slack":  {Type: "stdio"},
+					"jira":   {Type: "stdio"},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "multiple servers where one has guard-policies returns true",
+			cfg: &config.Config{
+				Servers: map[string]*config.ServerConfig{
+					"github": {Type: "stdio"},
+					"slack": {
+						Type:          "stdio",
+						GuardPolicies: allowOnlyPolicy,
+					},
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "multiple servers all with guard-policies returns true",
 			cfg: &config.Config{
 				Servers: map[string]*config.ServerConfig{
 					"github": {
+						Type:          "stdio",
+						GuardPolicies: allowOnlyPolicy,
+					},
+					"slack": {
+						Type:          "stdio",
+						GuardPolicies: allowOnlyPolicy,
+					},
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "mix of servers with and without empty guard-policies returns false",
+			cfg: &config.Config{
+				Servers: map[string]*config.ServerConfig{
+					"github": {Type: "stdio"},
+					"slack": {
 						Type:          "stdio",
 						GuardPolicies: map[string]interface{}{},
 					},
@@ -58,7 +120,7 @@ func TestHasServerGuardPolicies(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			result := hasServerGuardPolicies(tt.cfg)
-			assert.Equal(t, tt.expected, result, "hasServerGuardPolicies should return %v", tt.expected)
+			assert.Equal(t, tt.expected, result)
 		})
 	}
 }