test(rules): mirror and cover AG2-019

[bradAGI]

Engine half of a coordinated pair. Rules half: trustabl/trustabl-rules#106, on a branch of the same name, so the rules-sync job resolves the matching pack rather than main. Neither half should merge alone — check-rules-sync.sh fails if they do.

What the pair adds

Ports the ambiguous-name check to this pack. CSDK-007, OAI-007, ADK-007, and MCP-003 all ship it; the newer packs had none. Same name_in list as CSDK-007.

What this PR does

1. Mirrors autogen/tool_definition.yaml into testdata/rules-fixture/.
2. Adds cases to policyRuleCases, as TestPolicyRules_AllRulesCovered requires.

case	expectation
def process(...)	fires
def summarize_invoice(...)	silent
def process_invoice_batch(...)	silent

Three cases rather than two. The third is the one worth having: process_invoice_batch merely contains a listed word. It pins that name_in matches the whole name rather than a substring — the plausible regression, and the one that would otherwise flood well-named tools with findings across every pack using this list at once.

Verification

$ RULES_REPO=../trustabl-rules scripts/check-rules-sync.sh
rules fixture is in sync with production (86 files compared)

$ go vet ./internal/rules/
$ go test ./internal/rules/
ok  	github.com/trustabl/trustabl/internal/rules