It's like trying to prove an author didn't use a ghostwriter. You might be able to find some clues, but the smaller the sample and the more cleanup the author did, the less chance there is to detect it.

Now what if they're using AI for debugging? Code from the AI may not even make it into the project, but that doesn't mean AI wasn't used. So how do you enforce a "no AI" policy in that scenario?

If there's no practical way to enforce a rule or tell if it has been broken, it's a pointless rule. Better programmers than me have settled on the policy of "If you track in shit on your shoes, you will be the one cleaning it up, and may well be told to not come back if you do." Make people responsible for the code they submit, and if they can't do it right, however they do it, don't merge their code and kick them out.