[codex] add toolregistry unit coverage

[haasonsaas]

Summary

• add direct toolregistry package tests for required-field validation, not-found lookups, overwrite behavior, and returned-copy semantics
• keep the slice scoped to the registry package itself instead of only relying on indirect coverage through internal/app

Why

asb#61 still called out the lack of direct toolregistry unit tests. This keeps that gap small and reviewable without mixing in the larger durable-audit or Helm work.

Validation

• go test ./internal/authz/toolregistry -count=1
• go test ./... -count=1
• GOTOOLCHAIN=go1.26.0 go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.3 run ./internal/authz/toolregistry ./internal/app
• git diff --check

Scope

This is a second bounded slice of asb#61, limited to direct toolregistry unit coverage.

[cursor]

PR Summary

Low Risk
Adds isolated unit tests only; no production logic changes, so behavior risk is minimal aside from tightening expectations around error types and copy semantics.

Overview
Adds a new registry_test.go to directly exercise toolregistry behavior.

Tests now assert Put rejects missing required fields with core.ErrInvalidRequest, Get returns core.ErrNotFound for unknown tools, Put+Get round-trips full core.Tool data, Get returns a defensive copy, and Put overwrites existing entries.

^{Reviewed by Cursor Bugbot for commit 8db8cff. Bugbot is set up for automated code reviews on this repo. Configure here.}