test: add unit tests for 6 previously-untested packages (R7)

Added pure unit tests for all packages that had 0% coverage. Where pure
logic was entangled with DB calls, extracted testable helpers first.

internal/domain (0% -> 100%):
- TestIsNil, TestCanTransition (all 30 state transitions), TestSentinelErrors,
  TestSignalTransitionsComplete

internal/learning (0% -> 26.2%):
- Refactored processGroup to extract 4 pure helpers: countOutcomes,
  computeConfidence, shouldValidate, shouldQuarantine
- TestWilsonLowerBound (monotonicity, edge cases, sample-size cap)
- TestCountOutcomes, TestComputeConfidence, TestShouldValidate,
  TestShouldQuarantine (table-driven)
- Remaining gap: extractPatterns/processGroup DB calls need make test-db

internal/policy (39% -> 50%):
- Extracted determineRoute from ClassifySignal (pure route logic)
- TestDetermineRoute (7 cases covering global/entity kill-switches, approval)
- Remaining gap: ClassifySignal/computeBlastRadius need DB mock

internal/knowledge (0% -> 14.2%):
- TestContentHash, TestStr, TestStrSlice, TestMapVal, TestToPGArray
- Documented latent bug: toPGArray doesn't escape " or \\ in tags
- Remaining gap: ingest* functions need make test-db

internal/actuator (0% -> 14.7%):
- TestSSHErrorClassString, TestClassifySSHError (11 cases incl. net.Error mock)
- TestParseProcedure, TestSetDefaultSSHTimeout
- Circuit breaker full state-machine test (open/close/reset/per-target)
- Remaining gap: ExecuteProcedure/ProvisionLXC need SSH+DB fixtures

internal/scheduler (0% -> 7.3%):
- TestParsePingLatency (Linux/macOS formats), TestAllowlistedScript
- TestEvaluateSeverity (threshold logic, crit:0 skip, signalKind fallback)
- Remaining gap: checkHTTP/checkTCP need httptest; runCheckPass needs DB

internal/notifier (0% -> 6.4%):
- TestHashToken, TestGenerateApprovalToken (HMAC re-derivation)
- Remaining gap: checkReaction/sendMatrixAlert need httptest; DB funcs need
  make test-db

All tests pass with -race. domain hits its 60% gate at 100%. The remaining
packages need integration tests (make test-db) and/or httptest-based tests
to reach their coverage gates — tracked as follow-up.

internal/policy/classify.go

@@ -92,21 +92,7 @@ func (c *Classifier) ClassifySignal(ctx context.Context, signalEntityID, targetE
 	}
 
 	// Determine route
-	route := "escalate"
-	autonomyCheck := ""
-
-	if globalAutoAct == "off" || globalAutoAct == "false" {
-		route = "escalate"
-		autonomyCheck = "blocked: global auto_act disabled"
-	} else if entityAutoAct == "true" {
-		route = "escalate"
-		autonomyCheck = "blocked: per-entity kill-switch"
-	} else if approvalRequired == "none" {
-		route = "auto-act"
-		autonomyCheck = "allowed"
-	} else {
-		autonomyCheck = "requires approval: " + approvalRequired
-	}
+	route, autonomyCheck := determineRoute(globalAutoAct, entityAutoAct, approvalRequired)
 
 	// Compute blast radius
 	blastRadius := computeBlastRadius(ctx, c.DB, targetEntityID)
@@ -136,6 +122,21 @@ func (c *Classifier) ClassifySignal(ctx context.Context, signalEntityID, targetE
 	}, nil
 }
 
+// determineRoute evaluates autonomy settings and approval requirements to
+// decide whether a signal should auto-act, escalate, or hold for approval.
+func determineRoute(globalAutoAct, entityAutoAct, approvalRequired string) (route, autonomyCheck string) {
+	if globalAutoAct == "off" || globalAutoAct == "false" {
+		return "escalate", "blocked: global auto_act disabled"
+	}
+	if entityAutoAct == "true" {
+		return "escalate", "blocked: per-entity kill-switch"
+	}
+	if approvalRequired == "none" {
+		return "auto-act", "allowed"
+	}
+	return "escalate", "requires approval: " + approvalRequired
+}
+
 // computeBlastRadius traverses relationships to find affected entities.
 func computeBlastRadius(ctx context.Context, dbc interface {
 	Query(ctx context.Context, sql string, args ...any) (pgx.Rows, error)