Add tests pinning the empty-forbidden and empty-appropriate rate conventions

[bamdadd]

Context

score() in src/context_leak/scoring.py defines disclosure-rate as 0.0 when forbidden is empty and utility as 1.0 when appropriate_flows is empty (documented in ScoreResult and docs/DESIGN.md §2). These boundary conventions have no direct test, so a refactor could silently divide by zero or flip a default without failing CI.

Acceptance criteria

• Test: a scenario with empty forbidden scores disclosure-rate exactly 0.0 (no ZeroDivisionError) regardless of outputs.
• Test: a scenario with empty appropriate_flows scores utility exactly 1.0 regardless of outputs.
• Test: the naive agent on the built-in suite yields the expected non-zero aggregate disclosure-rate (documents the discriminating case).
• Tests live under tests/, deterministic, no network.