live_policy test isolation: STATE OnceLock has no reset (first install() wins for whole binary)

[sanil-23]

Severity: valid (latent).

STATE is a OnceLock with no reset path, so the first test to call install() wins for the entire test binary. Same class as the bug already chased. Reviewer accepts it temporarily.

Action: document the limitation + file a follow-up to add a reset/override hook for test isolation.

(Origin: review comments #2 / #14.)