test: add unit tests for 6 previously-untested packages (R7)

Added pure unit tests for all packages that had 0% coverage. Where pure
logic was entangled with DB calls, extracted testable helpers first.

internal/domain (0% -> 100%):
- TestIsNil, TestCanTransition (all 30 state transitions), TestSentinelErrors,
  TestSignalTransitionsComplete

internal/learning (0% -> 26.2%):
- Refactored processGroup to extract 4 pure helpers: countOutcomes,
  computeConfidence, shouldValidate, shouldQuarantine
- TestWilsonLowerBound (monotonicity, edge cases, sample-size cap)
- TestCountOutcomes, TestComputeConfidence, TestShouldValidate,
  TestShouldQuarantine (table-driven)
- Remaining gap: extractPatterns/processGroup DB calls need make test-db

internal/policy (39% -> 50%):
- Extracted determineRoute from ClassifySignal (pure route logic)
- TestDetermineRoute (7 cases covering global/entity kill-switches, approval)
- Remaining gap: ClassifySignal/computeBlastRadius need DB mock

internal/knowledge (0% -> 14.2%):
- TestContentHash, TestStr, TestStrSlice, TestMapVal, TestToPGArray
- Documented latent bug: toPGArray doesn't escape " or \\ in tags
- Remaining gap: ingest* functions need make test-db

internal/actuator (0% -> 14.7%):
- TestSSHErrorClassString, TestClassifySSHError (11 cases incl. net.Error mock)
- TestParseProcedure, TestSetDefaultSSHTimeout
- Circuit breaker full state-machine test (open/close/reset/per-target)
- Remaining gap: ExecuteProcedure/ProvisionLXC need SSH+DB fixtures

internal/scheduler (0% -> 7.3%):
- TestParsePingLatency (Linux/macOS formats), TestAllowlistedScript
- TestEvaluateSeverity (threshold logic, crit:0 skip, signalKind fallback)
- Remaining gap: checkHTTP/checkTCP need httptest; runCheckPass needs DB

internal/notifier (0% -> 6.4%):
- TestHashToken, TestGenerateApprovalToken (HMAC re-derivation)
- Remaining gap: checkReaction/sendMatrixAlert need httptest; DB funcs need
  make test-db

All tests pass with -race. domain hits its 60% gate at 100%. The remaining
packages need integration tests (make test-db) and/or httptest-based tests
to reach their coverage gates — tracked as follow-up.

internal/learning/learning.go

@@ -83,27 +83,13 @@ func extractPatterns(ctx context.Context, pool *db.Pool, watermark time.Time) ti
 func processGroup(ctx context.Context, pool *db.Pool, q *sqlcgen.Queries,
 	appliesType, action string, items []sqlcgen.GetFeedbackAfterWatermarkRow) {
 
-	successCount := 0
-	failureCount := 0
-	for _, f := range items {
-		switch f.Outcome {
-		case "success":
-			successCount++
-		case "failure", "unexpected":
-			failureCount++
-		case "partial":
-			successCount++ // partial counts as half-success
-		}
-	}
+	successCount, failureCount := countOutcomes(items)
 	total := successCount + failureCount
 	if total == 0 {
 		return
 	}
 
-	// Compute Wilson score lower bound
-	confidence := wilsonLowerBound(float64(successCount), float64(total), 0.95)
-	// Cap by sample size: nothing looks confident before 5 samples
-	confidence = math.Min(confidence, float64(total)/5.0)
+	confidence := computeConfidence(successCount, failureCount)
 
 	// Get or create pattern — first look up existing entity, then upsert.
 	existing, err := q.GetPattern(ctx, sqlcgen.GetPatternParams{
@@ -148,7 +134,7 @@ func processGroup(ctx context.Context, pool *db.Pool, q *sqlcgen.Queries,
 		return
 	}
 
-	if pat.EvidenceCount >= 5 && pat.Confidence >= 0.7 && !pat.Quarantined {
+	if shouldValidate(int(pat.EvidenceCount), float64(pat.Confidence), pat.Quarantined) {
 		_ = q.UpdatePatternStatus(ctx, sqlcgen.UpdatePatternStatusParams{
 			EntityID: pat.EntityID,
 			Status:   "validated",
@@ -158,8 +144,7 @@ func processGroup(ctx context.Context, pool *db.Pool, q *sqlcgen.Queries,
 			"confidence", confidence, "samples", total)
 	}
 
-	// Anomaly check: >10 identical outcomes within 1h
-	if total > 10 {
+	if shouldQuarantine(total) {
 		_ = q.UpdatePatternQuarantine(ctx, sqlcgen.UpdatePatternQuarantineParams{
 			EntityID:    pat.EntityID,
 			Quarantined: true,
@@ -169,6 +154,45 @@ func processGroup(ctx context.Context, pool *db.Pool, q *sqlcgen.Queries,
 	}
 }
 
+// countOutcomes tallies feedback items into success and failure counts.
+// "partial" counts as a half-success (increments success).
+func countOutcomes(items []sqlcgen.GetFeedbackAfterWatermarkRow) (success, failure int) {
+	for _, f := range items {
+		switch f.Outcome {
+		case "success":
+			success++
+		case "failure", "unexpected":
+			failure++
+		case "partial":
+			success++
+		}
+	}
+	return success, failure
+}
+
+// computeConfidence calculates the Wilson score lower bound, capped by
+// sample size (nothing looks confident before 5 samples).
+func computeConfidence(success, failure int) float64 {
+	total := success + failure
+	if total == 0 {
+		return 0
+	}
+	confidence := wilsonLowerBound(float64(success), float64(total), 0.95)
+	return math.Min(confidence, float64(total)/5.0)
+}
+
+// shouldValidate returns true when a pattern has enough evidence and
+// confidence to be promoted from "hypothesized" to "validated".
+func shouldValidate(evidenceCount int, confidence float64, quarantined bool) bool {
+	return evidenceCount >= 5 && confidence >= 0.7 && !quarantined
+}
+
+// shouldQuarantine returns true when an anomaly burst is detected
+// (>10 identical outcomes, indicating a runaway loop rather than organic feedback).
+func shouldQuarantine(total int) bool {
+	return total > 10
+}
+
 // wilsonLowerBound computes the Wilson score interval lower bound.
 // Conservative estimate of success rate for small sample sizes.
 func wilsonLowerBound(success, total, z float64) float64 {