DevOps — Expand pytest coverage to 300+ tests (Phase 2 rules)

[TFT444]

Overview

Once all Phase 2 KQL rules are merged (4 LP + 2 ChainShield = 6 new rules), expand the pytest test suite to cover all new rules and push total coverage above 300 assertions.

Scope

• Ensure tests/test_lp_rules.py (Loss Prevention — pytest unit tests for all LP KQL rules #128) and tests/test_chainshield_rules.py (ChainShield — pytest unit tests for KQL rules #134) are integrated into the main test runner
• Add integration test: run validate_kql.py against every .kql file in detection-rules/ and assert 19/19 pass
• Add a count assertion: total .kql files ≥ 26 (20 existing + 6 Phase 2)
• Update CI badge in README if test count displayed

Acceptance criteria

• pytest tests/ -v passes with ≥ 300 assertions
• All 26 rules covered
• CI green on dev and main
• README test count updated if shown

Part of

Phase 2 DevOps
Depends on: #128, #134