fix(policy): contains operator case-insensitive on list-membership branch

Pre-fix:
  case "contains":
      if isinstance(val, str) and isinstance(pv, str):
          return pv.lower() in val.lower()           # CI
      return isinstance(val, (list, tuple, set)) and pv in val  # case-SENSITIVE

The string-in-string branch was already case-insensitive (matching the
``_ci``-equivalent treatment that ``eq`` / ``in`` / ``not_in`` apply),
but the list-membership branch fell through to Python's default ``in``
operator. A rule listing ``["light.kitchen"]`` would not fire on an
LLM passing ``["Light.Kitchen"]`` — silent gate failure.

Bring it in line with the other string-op branches via per-element
``_ci``, which passes non-string entries through unchanged so
mixed-type collections still get natural equality semantics.

Caught by Gemini Code Assist on homeassistant-ai#1431; addressing inline rather than
opening a follow-up because the policy module is now in master
(homeassistant-ai#1421) and any reviewer running the suite would see the
case-sensitivity asymmetry in the existing TestCaseInsensitive class.

Author: kingpanther13

src/ha_mcp/policy/evaluator.py

@@ -84,7 +84,14 @@ def _op_matches(val: Any, op: str, pv: Any) -> bool:
         case "contains":
             if isinstance(val, str) and isinstance(pv, str):
                 return pv.lower() in val.lower()
-            return isinstance(val, (list, tuple, set)) and pv in val
+            # Mirror the case-insensitive treatment that ``eq`` / ``in`` /
+            # ``not_in`` already apply: a rule listing ``["light.kitchen"]``
+            # must match an LLM passing ``"Light.Kitchen"``. Per-element
+            # ``_ci`` guards non-string entries so mixed-type collections
+            # (e.g. ``[1, "two"]``) keep their natural equality semantics.
+            return isinstance(val, (list, tuple, set)) and any(
+                _ci(pv) == _ci(x) for x in val
+            )
         case "gt":
             try:
                 return bool(val > pv)

tests/src/unit/policy/test_evaluator.py

@@ -195,6 +195,25 @@ def test_non_string_types_preserve_natural_equality(self):
         p = Predicate(path="args.x", op="eq", value="1")
         assert match_predicate(p, {"x": 1}) is False
 
+    def test_contains_list_membership_ignores_case(self):
+        # ``contains`` against a list/tuple/set must mirror ``in`` /
+        # ``not_in`` — a rule listing ``"light.kitchen"`` has to fire
+        # when the LLM passes ``["Light.Kitchen"]``. Pre-fix this
+        # branch was case-sensitive while every other op was CI.
+        p = Predicate(path="args.entity_id", op="contains", value="light.kitchen")
+        assert match_predicate(p, {"entity_id": ["Light.Kitchen"]}) is True
+        assert (
+            match_predicate(p, {"entity_id": ("LIGHT.KITCHEN", "other.thing")}) is True
+        )
+        assert match_predicate(p, {"entity_id": {"foo", "Light.Kitchen"}}) is True
+
+    def test_contains_list_membership_non_string_elements_preserve_equality(self):
+        # Mixed-type collections must keep natural equality for the
+        # non-string entries — _ci passes non-strings through unchanged.
+        p = Predicate(path="args.x", op="contains", value=42)
+        assert match_predicate(p, {"x": [1, 42, "three"]}) is True
+        assert match_predicate(p, {"x": ["1", "42"]}) is False  # int != "42"
+
 
 # --- wildcard path semantics (catch-all "any argument matches X") ---
 class TestWildcardPredicate: