ChainShield — pytest unit tests for KQL rules

[TFT444]

Overview

Add pytest tests for both ChainShield KQL rules following the existing test pattern in tests/.

Rules to cover

• chainshield-supplier-compromise.kql (ChainShield — Supplier compromise detection KQL rule #130)
• chainshield-logistics-diversion.kql (ChainShield — Logistics/cargo diversion fraud KQL detection rule #131)

Test checks per rule

• Required metadata comments present
• Known Sentinel/custom table reference
• Balanced parentheses and brackets
• ago() time filter present
• No project *
• No placeholder text
• Correct MITRE technique
• RiskScore field projected

Acceptance criteria

• Test file: tests/test_chainshield_rules.py
• All tests pass: pytest tests/test_chainshield_rules.py -v
• CI pipeline stays green

Part of

Epic #117 — Phase 2 ChainShield
Depends on: #130, #131