Add coverage raised in review (originally generated in a separate PR):
- gRPC CheckLLMPolicyLimits handler: model forwarding, empty-model passthrough,
model_blocked deny envelope, selector-error -> Internal, unconfigured ->
Unimplemented.
- selector: guardrail-lookup error propagates, orphaned guardrail reference is
unrestricted, model filter narrows candidates before cap scoring.
- proxy guardrail: enabled-but-empty allowlist and all-blank factory entries
both deny every model for the provider.