Run policy tests

## Usage

`circleci policy test <path> [flags]`

## Arguments

`<path>` is a directory of policies and tests. Append `/...`
to discover tests recursively in every subdirectory.

## Flags

| Flag           | Description                                                                                                       |
| -------------- | ----------------------------------------------------------------------------------------------------------------- |
| `--all`        | Show all tests, not just failures                                                                                 |
| `--explain`    | Print each test's full evaluation context (implies --all)                                                         |
| `--jq string`  | Process values from the response using jq syntax (see `circleci help formatting`)                                 |
| `--json`       | Output as JSON                                                                                                    |
| `--junit`      | Output results as JUnit XML                                                                                       |
| `--org string` | Organization slug (e.g. gh/myorg) or UUID for private orb resolution when a test compiles; defaults to git remote |
| `--run string` | Only run tests whose name matches this regexp                                                                     |

Global flags: `-c, --config`, `--debug`, `--no-color`, `-q, --quiet` — see `circleci --help`.

## Examples

- Run every test under ./policies and its subdirectories: 
  `circleci policy test ./policies/...`
- Run tests in a single directory, showing passing tests too: 
  `circleci policy test ./policies --all`
- Run only tests whose name matches a regexp: 
  `circleci policy test ./policies/... --run 'test_enforce_.*'`
- Emit JUnit XML for CI: 
  `circleci policy test ./policies/... --junit`

## Details

Discover and run policy tests locally, exiting non-zero if any fails.

Tests live in *_test.yaml files alongside your .rego policies; each test key
must start with "test_" and compares its expected "decision" against the
engine's decision for its "input". Native OPA unit tests run too.

An input is compiled first only when it sets "compile: true" or provides
"pipeline_parameters", so --org and a token are needed only in that case.

JSON fields: Passed, Group, Name, Elapsed, ElapsedMS, Err, Ctx

