fix(flags): do not match empty OR cohorts

[Kayvan-Zahiri]

💡 Motivation and Context

An empty OR cohort currently matches every user during local flag evaluation. A flag targeting that cohort is therefore enabled, while a not_in condition incorrectly excludes everyone. This also affects empty OR groups nested inside other cohort groups.

Return the group's Boolean identity when its values list is empty: false for OR, true for AND. The canonical empty object {} remains a match. This follows the published local evaluator contract for empty cohort groups; it changes no public API surface. The earlier cohort fix #836 preserved empty groups but did not cover empty OR semantics.

💚 How did you test it?

• Before the fix, all nine regression cases failed: empty root/nested groups and default/in/not_in cohort membership through single and bulk flag evaluation. They now pass, and the public API tests assert no remote fallback.
• Focused flag/evaluation/versioning suites: 629 passed, 15 subtests passed.
• Full suite on Python 3.13.4: 4,205 passed, 16 skipped, 48 subtests passed (PYTHONPATH=$PWD .venv/bin/python -m pytest --verbose --timeout=30). The explicit import path is needed on this macOS checkout because its editable-install .pth is marked hidden and ignored by subprocess interpreters.
• Full-repository Ruff format/lint, Mypy with the repository baseline, public API snapshot and its checker tests, warning-free import, and git diff --check all pass.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran sampo add to generate a changeset file.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Kayvan-Zahiri is the DRI. GitHub rejected the self-assignment update for this external contribution; maintainer assignment is needed.

Codex identified the contract mismatch, wrote and ran the regressions, and prepared this change using shell tools, pytest, and the GitHub CLI. A second Codex agent reviewed the diff. The development session is private; no independent human code review is claimed. This draft is ready for maintainer review.