test(eval): add Node + wasmtime + CI coverage for object iteration

CI gap: zig build test-unit was not run by CI, so the unit tests in
src/eval.zig (every over object keys / values / default) were never
validated upstream.

Fixes:
- ci.yml gains a test-unit job that runs zig build test-unit on
  ubuntu-latest. Independent of the build matrix; needs only the
  Zig toolchain.
- test/run.mjs gains 6 cases covering every / some over object refs
  with kind=keys, kind=values, and the default (kind omitted).
- test/run_wasmtime.py gets the same 6 cases (parity with run.mjs).

Author: kanywst

test/run.mjs

@@ -423,6 +423,70 @@ check(
   0,
 );
 
+// ---------------------------------------------------------------------------
+// 9. some / every over object refs (kind: keys / values, default keys)
+// ---------------------------------------------------------------------------
+const everyKeyNotInternal = {
+  type: 'every', var: 'k', kind: 'keys',
+  source: { type: 'ref', path: ['input', 'attrs'] },
+  body: {
+    type: 'neq',
+    left: { type: 'ref', path: ['k'] },
+    right: { type: 'value', value: 'internal' },
+  },
+};
+check(
+  'every over object keys: no banned key -> allow',
+  decide({ attrs: { team: 'sre', region: 'us-east' } }, everyKeyNotInternal),
+  1,
+);
+check(
+  'every over object keys: banned key present -> deny',
+  decide({ attrs: { team: 'sre', internal: 'yes' } }, everyKeyNotInternal),
+  0,
+);
+
+const someValueTrue = {
+  type: 'some', var: 'v', kind: 'values',
+  source: { type: 'ref', path: ['input', 'flags'] },
+  body: {
+    type: 'eq',
+    left: { type: 'ref', path: ['v'] },
+    right: { type: 'value', value: true },
+  },
+};
+check(
+  'some over object values: at least one true -> allow',
+  decide({ flags: { a: false, b: true, c: false } }, someValueTrue),
+  1,
+);
+check(
+  'some over object values: all false -> deny',
+  decide({ flags: { a: false, b: false } }, someValueTrue),
+  0,
+);
+
+// `kind` defaults to "keys" when omitted on an object source.
+const everyDefaultKeysNotBanned = {
+  type: 'every', var: 'k',
+  source: { type: 'ref', path: ['input', 'm'] },
+  body: {
+    type: 'neq',
+    left: { type: 'ref', path: ['k'] },
+    right: { type: 'value', value: 'banned' },
+  },
+};
+check(
+  'every over object defaults to keys: clean -> allow',
+  decide({ m: { x: 1, y: 2 } }, everyDefaultKeysNotBanned),
+  1,
+);
+check(
+  'every over object defaults to keys: banned -> deny',
+  decide({ m: { x: 1, banned: 2 } }, everyDefaultKeysNotBanned),
+  0,
+);
+
 if (failed > 0) {
   console.error(`\n${failed} test(s) failed`);
   exit(1);

test/run_wasmtime.py

@@ -300,6 +300,70 @@ def check(name: str, got, expected):
     0,
 )
 
+# ---------------------------------------------------------------------------
+# 9. some / every over object refs (kind: keys / values, default keys)
+# ---------------------------------------------------------------------------
+every_key_not_internal = {
+    "type": "every", "var": "k", "kind": "keys",
+    "source": {"type": "ref", "path": ["input", "attrs"]},
+    "body": {
+        "type": "neq",
+        "left": {"type": "ref", "path": ["k"]},
+        "right": {"type": "value", "value": "internal"},
+    },
+}
+check(
+    "every over object keys: no banned key -> allow",
+    decide({"attrs": {"team": "sre", "region": "us-east"}}, every_key_not_internal),
+    1,
+)
+check(
+    "every over object keys: banned key present -> deny",
+    decide({"attrs": {"team": "sre", "internal": "yes"}}, every_key_not_internal),
+    0,
+)
+
+some_value_true = {
+    "type": "some", "var": "v", "kind": "values",
+    "source": {"type": "ref", "path": ["input", "flags"]},
+    "body": {
+        "type": "eq",
+        "left": {"type": "ref", "path": ["v"]},
+        "right": {"type": "value", "value": True},
+    },
+}
+check(
+    "some over object values: at least one true -> allow",
+    decide({"flags": {"a": False, "b": True, "c": False}}, some_value_true),
+    1,
+)
+check(
+    "some over object values: all false -> deny",
+    decide({"flags": {"a": False, "b": False}}, some_value_true),
+    0,
+)
+
+# `kind` defaults to "keys" when omitted on an object source.
+every_default_keys = {
+    "type": "every", "var": "k",
+    "source": {"type": "ref", "path": ["input", "m"]},
+    "body": {
+        "type": "neq",
+        "left": {"type": "ref", "path": ["k"]},
+        "right": {"type": "value", "value": "banned"},
+    },
+}
+check(
+    "every over object defaults to keys: clean -> allow",
+    decide({"m": {"x": 1, "y": 2}}, every_default_keys),
+    1,
+)
+check(
+    "every over object defaults to keys: banned -> deny",
+    decide({"m": {"x": 1, "banned": 2}}, every_default_keys),
+    0,
+)
+
 if failed:
     print(f"\n{failed} test(s) failed", file=sys.stderr)
     sys.exit(1)