test: lift coverage on policy (70.9% → 98.8%) and inventory/wiz (73.3% → 88.9%)

[Kiran01bm]

What and Why ?

Picks up the two coverage targets the round-1 coverage PR (#60) deliberately
punted, plus a tiny lint fix on EOLConfig that surfaced after the round-1
baseline.

Coverage

Package	Before	After
pkg/policy	70.9%	98.8%
pkg/inventory/wiz	73.3%	88.9%

Production-code changes (2, both non-behavioral)

pkg/inventory/wiz/http_client.go — added package-private authURL and
graphqlURL fields on HTTPClient. NewHTTPClient defaults them to the
existing wizAuthURL / wizGraphQLURL constants, so production callers see
no behavioral or API change. Tests can now construct an *HTTPClient
literal pointed at an httptest.Server without a new public constructor or
env var.

pkg/config/types.go — added //nolint:govet // YAML field order chosen for readability of resources.yaml on EOLConfig. Same wire-format-stability
rationale already applied to Snapshot, SnapshotSummary, WorkflowOutput,
etc. in #59 — struct field order surfaces in YAML emission order, so
reordering would silently rewrite how resources.yaml round-trips.

New tests

• pkg/policy/messages_test.go — branch coverage for
  DefaultPolicy.GetMessage (every status arm + bogus-status default),
  GetRecommendation (every status arm + with/without upgrade target),
  usableUpgradeTarget (empty / equals-cycle / equals-current / valid
  candidate), versionMatches (exact, prefix, mismatch, k8s- and
  kubernetes- prefix stripping, bare-major false-prefix guard), and the
  two Classify branches round-1 didn't exercise.

• pkg/inventory/wiz/http_client_test.go — network-side coverage of
  HTTPClient driven by httptest.Server: NewHTTPClient defaults,
  GetAccessToken (happy / non-200 / bad JSON / transport error),
  GetReport (happy / lastRun-not-COMPLETED / GraphQL errors[] / HTTP
  5xx), doGraphQL retry behavior (rate-limit retried then succeeds;
  rate-limit then context cancelled mid-backoff returns ctx error),
  DownloadReport (happy / non-200 / transport error).

Verification

All commands run with GOTOOLCHAIN=go1.24.2 (see toolchain caveat noted on #59):

• go build ./... → clean
• go test ./... → all packages green
• golangci-lint run ./... → 0 findings (PR chore(lint): clear pre-existing golangci-lint baseline (20 → 0 findings) #59 lint baseline preserved)
• go test ./pkg/policy ./pkg/inventory/wiz -cover → 98.8% / 88.9%