fix(cas): make audit dispatcher nil-claims safe

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 0c60a332-e0f1-4c2b-94ae-533467e52f5c

Author: migmartri

app/artifact-cas/internal/service/auditor.go

@@ -53,7 +53,7 @@ func NewAuditDispatcher(publisher *auditor.AuditLogPublisher, logger log.Logger)
 // shouldEmit returns true when Dispatch would actually publish an event for the
 // given claims. Hooks use it to skip extra work (e.g. backend Describe round-trips).
 func (d *AuditDispatcher) shouldEmit(claims *casJWT.Claims) bool {
-	return d != nil && d.publisher != nil && !claims.SourceInternal
+	return d != nil && d.publisher != nil && claims != nil && !claims.SourceInternal
 }
 
 // Dispatch generates and publishes an audit event with a SYSTEM actor and the

app/artifact-cas/internal/service/auditor_test.go

@@ -149,6 +149,7 @@ func TestAuditDispatcherShouldEmit(t *testing.T) {
 	}{
 		{name: "nil dispatcher", dispatcher: nil, claims: &casJWT.Claims{}, want: false},
 		{name: "nil publisher", dispatcher: newTestDispatcher(nil), claims: &casJWT.Claims{}, want: false},
+		{name: "nil claims", dispatcher: newTestDispatcher(&fakePublisher{}), claims: nil, want: false},
 		{name: "internal traffic", dispatcher: newTestDispatcher(&fakePublisher{}), claims: &casJWT.Claims{SourceInternal: true}, want: false},
 		{name: "client traffic", dispatcher: newTestDispatcher(&fakePublisher{}), claims: &casJWT.Claims{}, want: true},
 	}