fix: guard CombineExprs against zero args

Author: dangrondahl

internal/policy/expression.go

@@ -55,6 +55,9 @@ func ComparisonExpr(context, op, value string) string {
 
 // CombineExprs joins inner expressions (without ${{ }} wrappers) with a logical operator.
 func CombineExprs(op string, exprs ...string) string {
+	if len(exprs) == 0 {
+		return ""
+	}
 	if len(exprs) == 1 {
 		return WrapExpr(exprs[0])
 	}

internal/policy/expression_test.go

@@ -68,6 +68,11 @@ func TestCombineExprs_Single(t *testing.T) {
 	assert.Equal(t, `${{ flow.name == "prod" }}`, result)
 }
 
+func TestCombineExprs_Empty(t *testing.T) {
+	result := CombineExprs("and")
+	assert.Equal(t, "", result)
+}
+
 func TestWrapExpr_AddsWrapper(t *testing.T) {
 	result := WrapExpr(`flow.name == "prod"`)
 	assert.Equal(t, `${{ flow.name == "prod" }}`, result)