refactor(cli): drop dead fallback in validatePolicyEnforcement

Remove the `len(PolicyEvaluations) == 0 && HasPolicyViolations` backward-compatibility
fallback from validatePolicyEnforcement. Both fields are always produced together by a
single call to getPolicyEvaluations(), so if the evaluations map is empty HasPolicyViolations
is always false — the condition is structurally unreachable.

Flatten the nested `if MustBlockOnPolicyViolations { if bypassPolicyCheck { ... } }` to
a single `if MustBlockOnPolicyViolations && bypassPolicyCheck { ... }` for clarity.

Signed-off-by: Matías Insaurralde <matias@chainloop.dev>

Author: matiasinsaurralde

app/cli/cmd/attestation_push.go

@@ -194,20 +194,11 @@ func validatePolicyEnforcement(status *action.AttestationStatusResult, bypassPol
 		}
 	}
 
-	// Do a final check in case the operator has configured the attestation
-	// to be blocked on any policy violation.
-	if status.MustBlockOnPolicyViolations {
-		if bypassPolicyCheck {
-			logger.Warn().Msg(exceptionBypassPolicyCheck)
-			return nil
-		}
-
-		// Effective gate semantics are already resolved in policy evaluations.
-		// For backwards compatibility, fall back to aggregate status only if
-		// no evaluations are available.
-		if len(status.PolicyEvaluations) == 0 && status.HasPolicyViolations {
-			return ErrBlockedByPolicyViolation
-		}
+	// Block on any policy violation only when configured (bypass handled above).
+	// When we have policy evaluations, gate semantics are already enforced in the loop above.
+	if status.MustBlockOnPolicyViolations && bypassPolicyCheck {
+		logger.Warn().Msg(exceptionBypassPolicyCheck)
+		return nil
 	}
 
 	return nil