(tests): add tests for secrets resolver logic

[krisztianfekete]

Test coverage for #158

[Copilot]

Pull request overview

Adds unit-level test coverage for the secret resolver framework introduced in #158 and for judge credential injection behavior, focusing on fail-closed semantics, plugin/entry-point discovery, and concurrency isolation.

Changes:

• Adds tests for resolver registry behavior: entry-point discovery, precedence, env resolver, and the ContextVar-based resolved-credential carrier.
• Adds mocked Kubernetes resolver tests (base64 decoding, missing fields, non-leaking errors, and optional-extra failure).
• Adds tests for judge credential injection (LiteLLM + Gemini paths), unresolved-credential fail-closed behavior, and a guard for the ADK “judge seam”.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/test_credential_injection.py	Tests judge credential injection behavior, fail-closed unresolved credentials, concurrency isolation, and ADK seam guards.
tests/resolvers/test_registry.py	Tests resolver kind discovery, precedence rules, env resolver behavior, entry-point loading behavior, and ContextVar credential storage.
tests/resolvers/test_kubernetes.py	Tests KubernetesSecretResolver behavior with a mocked client and validates optional-extra error path.
tests/resolvers/__init__.py	Ensures tests.resolvers is a package (supports consistent test module imports/discovery).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.