feat: assessment logging, synced with the server-side entitlement gate

[alistairsmith-tech]

Syncs the assessment-logging branch with the server-side gate landing in monocle-services#153.

what changed

monocle-services now omits PolicyResponse.assessment for orgs whose plan lacks the assessment-logging entitlement. Nothing here broke: the SDK does a bare response.json() with no validation, so the field is simply undefined, and no plugin dereferences it.

But each plugin would have written a line announcing itself as an assessment log while carrying no assessment. An unentitled org would fill their logs with empty records and reasonably ask why. So the helper now returns early when the assessment is absent.

No change for an entitled org: the assessment is present and the line is written exactly as before. The verify decision is untouched either way, since the gate only removes data from the response.

also in here

Merged main (the branch was a few commits behind) and corrected the test fixtures, which mocked decisions with no assessment field at all. That was never a shape the policy API returned.

the gate does NOT cover this plugin end to end

Worth being explicit, because it is easy to assume otherwise. USE_POLICY_API selects the mode:

return env.USE_POLICY_API === 'true'
    ? validateWithPolicyApi(request, env)
    : validateWithDecrypt(request, env);

The decrypt path with no PRIVATE_KEY calls /api/v1/assessment, which is not entitlement-gated, and logs the full assessment. So an unentitled org can still log assessments by flipping one worker variable. The server-side gate covers policy mode only, by design, since on /api/v1/assessment the assessment is the payload rather than something incidental we can withhold.

test evidence

Full suite green.