Fill test coverage gaps

[dgenio]

Summary

Audit all test files and fill any gaps.

Process

1. Run python -m pytest --cov=agent_kernel --cov-report=term-missing
2. Identify modules with < 80% coverage
3. Add tests for uncovered branches
4. Target: >= 80% coverage on core modules (kernel, firewall, policy, tokens, handles)

Acceptance criteria

• Coverage report generated
• Core modules >= 80% coverage
• No test files with only stubs/placeholders