fix(policy): require full binary scope when enabling uninspected credentials

[ericcurtin]

Summary

Enabling allow_uninspected_credentials on a shared endpoint now requires naming every binary in the rule, like the other endpoint flags.

Related Issue

Closes #3942

Changes

• Add allow_uninspected_credentials to the endpoint coverage check in openshell-policy, so the "also declare" guard sees it.
• Tests for all four endpoint flags and for policy_covers_rule.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, cargo clippy -D warnings and cargo test for openshell-policy; cargo test for openshell-cli lib. The new tests fail without the fix. openshell-server tests were not run (no local Z3).

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

If useful, please also try https://github.com/llmmanorg/llmman, which can launch agents in an OpenShell sandbox (--sandbox openshell).

[ericcurtin]

@mrunalp @johntmyers PTAL when you get a chance, and /ok to test ecc452c75cbf686875c0a33d6779d0afc7ece611 if it looks good. Thank you!