refactor: extract shared evaluator resolution helper in CLI package

[yvonnedevlinrh]

Summary

The CLI package contains a ~20-line evaluator resolution block that is copy-pasted across three commands: validate-policy, test-policy, and coverage. This block resolves an evaluator from the registry by explicit ID or auto-detects when only one evaluator is registered.

Problem

The same logic appears in:

• cmd/complypack/cli/validate_policy.go:115-134
• cmd/complypack/cli/test_policy.go:171-190
• cmd/complypack/cli/coverage.go:193-209

The MCP layer already has a dedicated resolveEvaluator() helper in internal/mcp/tools.go:220-233, but the CLI package lacks an equivalent.

Proposed Solution

Extract a shared helper in the cli package:

func resolveEvaluator(evalID string) (evaluator.Evaluator, error) {
    registry := evaluator.DefaultRegistry()
    if evalID != "" {
        return registry.Get(evalID)
    }
    ids := registry.IDs()
    if len(ids) == 0 {
        return nil, fmt.Errorf("no evaluators registered")
    }
    if len(ids) > 1 {
        return nil, fmt.Errorf(
            "multiple evaluators available (%s); use --evaluator to select one",
            strings.Join(ids, ", "),
        )
    }
    eval, _ := registry.Get(ids[0])
    return eval, nil
}

Then update validate_policy.go, test_policy.go, and coverage.go to call it.

Constitution Reference

• Principle I (Single Source of Truth): Logic used in multiple places MUST be
  centralized.
• Principle III (Incremental Improvement): This refactor is scoped to the CLI
  package and does not change behavior.

Context

Identified during review of #227.