test(integration): HITL approve/reject + bloqueo por PII (NIF, email)

- test_invoke_hitl: escenario SIP real → awaiting_approval; approve devuelve
  status=completed con approved_actions; reject deja status=failed con
  error=rejected_by_human.
- test_invoke_pii_block: input con NIF español y email → status=blocked_by_guardrail
  y violación DetectPII con blocked=True.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/integration/test_invoke_pii_block.py

@@ -0,0 +1,13 @@
+"""Integration: input con PII (NIF español + email) bloqueado por guardrails de entrada."""
+
+import pytest
+
+
+@pytest.mark.integration
+def test_pii_es_nif_bloquea(integration_client) -> None:  # type: ignore[no-untyped-def]
+    pii_input = "El cliente con NIF 12345678Z reporta caída de servicio. Email juan@example.com"
+    r = integration_client.post("/agents/incident_analyzer/invoke", json={"input": pii_input})
+    assert r.status_code == 200
+    body = r.json()
+    assert body["status"] == "blocked_by_guardrail"
+    assert any(v["validator"] == "DetectPII" and v["blocked"] for v in body["violations"])