Reject test-only agent repairs

tests/test_policy.py

@@ -23,6 +23,16 @@ def test_policy_rejects_secrets_and_vendor_paths() -> None:
     assert len(result.errors) == 3
 
 
+def test_policy_rejects_test_only_repair() -> None:
+    result = evaluate_changes(
+        ChangeSummary(("tests/Unit/ExampleTest.php",), 20, 2),
+        settings(),
+    )
+
+    assert not result.allowed
+    assert "production behavior was not fixed" in result.errors[0]
+
+
 def test_direct_main_blocks_validator_and_migrations() -> None:
     config = replace(
         settings(),