test: add comprehensive validation coverage

[SHAURYAKSHARMA24]

Summary

This PR adds a comprehensive validation/test coverage pass for OpenShield against the current upstream/dev branch.

It adds scanner rule regression coverage for all 45 current scanner rules, extends MockAzureClient test support, adds ScanEngine integration tests, and documents the validation results in docs/validation/COMPREHENSIVE_VALIDATION_REPORT.md.

No production code is changed.

Verification

Local validation completed successfully:

pytest -q
# 170 passed

pytest tests/test_rules_*.py -q
# 92 passed

pytest tests/test_engine_integration.py -q
# 4 passed

[parthrohit22]

Good work on this PR. The scope is valuable and the changed files look mostly aligned with the stated goal: validation report, rule regression tests, engine integration tests, and mock Azure client support.

I reviewed the PR at a high level and I think this is moving in the right direction, but I would not approve until the merge conflict is resolved and the tests are rerun.

Main blocker:

• GitHub currently shows a merge conflict in tests/helpers/mock_azure.py.
• Since this file is central to the new test coverage, please resolve it carefully instead of choosing one side blindly.
• After resolving, please rerun:

pytest -q
pytest tests/test_rules_*.py -q
pytest tests/test_engine_integration.py -q

and confirm the final pass counts in the PR.

A few review notes:

• The PR description says no production code is changed, and from the file list I can see the scope is limited to tests and validation docs, which is good.
• The comprehensive validation report is useful, especially the documented findings around AZ-NET-009, AZ-NET-012, ai/chunker.py, Sentinel mapping, and scan observability.
• The limitation around AZ-NET-009 and AZ-NET-012 should remain clearly documented because those tests validate intended/mock behavior, not current production behavior.
• Please make sure the known issues found during validation are later raised as separate issues so they do not stay buried inside the report.

Suggested follow-up issues:

• AZ-NET-009 false negative due to SDK method mismatch
• AZ-NET-012 false positive due to missing get_nsg_flow_logs
• ai/chunker.py SyntaxError
• Sentinel compliance field mapping mismatch
• ScanEngine missing errored-rule visibility in scan results

Once the mock_azure.py conflict is resolved, tests are rerun, and the PR is updated with the latest results, I think this will be ready for final review.

[TFT444]

Seconding Parth's review he said everything.But One specific code change to make while you have the branch open for the conflict fix:

In [tests/test_engine_integration.py], test_engine_loads_all_45_rules asserts len(eng.rules) == 45. Change it to >= 45 .
Otherwise the next rule anyone adds will break this test for no reason, and it's not the count that matters here.

On the follow-up issues Parth listed — I'll open those once this PR merges so they don't get lost. No action needed from you on that side.