fix: harden autofix paths and isolate CodeQL output

[peaktwilight]

Changes

• Resolve scanner-emitted finding paths relative to the process directory, not by appending them to the scan root. This fixes nested relative-directory and single-file --fix runs.
• Restrict writes to the canonical scan directory or exact selected file; reject out-of-scope targets and escaping symlinks.
• Add the missing subprocess import to Python command-injection fixes, preserving shebangs, module docstrings, and future imports. Coalesce identical edits when multiple findings need the same import.
• Add behavioral regression coverage and document in-place fixes.

Verification

• Reproduced a supported Flask command-injection finding where the pre-fix binary left src/app.py unchanged with --fix src.
• Rebuilt CLI fixes both src and src/app.py. Generated two-call Python modules execute successfully with real subprocesses; one subprocess import, docstring and future-import preamble preserved.
• cargo fmt and cargo clippy --locked --all-targets --all-features -- -D warnings passed.
• cargo test --locked --all-features passed in the combined audit workspace: 1,618 passed, 6 explicitly ignored (including live CodeQL and benchmark/debug/doc harnesses).
• cargo build --locked --all-features --bins passed.

Canonical confinement is a scope check, not a claim of race-proof filesystem isolation.

CodeQL output isolation found during CI

• Keep each external CodeQL output namespace reserved until the child exits and SARIF is parsed; use Unix mode 0700 and automatic cleanup. Previously the NamedTempFile was dropped before spawning, leaving an unowned path and persistent raw SARIF.
• Extended an existing CLI comparison regression: the pre-fix binary fails because raw SARIF remains in the isolated temporary directory; the fix passes.
• All 13 CodeQL diff tests pass. Full Rust suite remained at 1,618 passing tests, 6 ignored; final permission hardening additionally passed Clippy, all CodeQL diff tests, and binary builds.
• Concurrent CLI smoke with a controlled CodeQL output probe: 20 scans, 20 distinct output directories, every directory mode 0700, zero leftover outputs. This exercises the external-tool handoff, not a live CodeQL query engine.

macOS concurrency-test repair

• Retrieved the canceled macOS run logs: final_review_rendering_and_newer_admission_share_the_pull_request_gate was stuck after the other 41 GitHub App tests completed.
• The two interleaving HTTP test servers now explicitly reset accepted sockets to blocking mode (macOS inherits the listener mode), bound request reads, and consume complete headers instead of discarding read errors. Production webhook behavior is unchanged.
• Local verification: Clippy with warnings denied and all 42 GitHub App tests pass. Required Linux/macOS CI reruns on the final commit before merge.

[peaktwilight]

Reviewed the rs/no-path-traversal annotations: the scan root is the operator-selected boundary, and finding targets are canonicalized then required to remain within that directory (or equal the selected file) before reading/writing. The added tests exercise actual fixable findings and reject outside targets and escaping symlinks. These syntactic Path::new warnings do not identify an unguarded write. Semgrep CI failed before tests because the hosted runner had a partially installed Rust 1.88 toolchain / cargo-clippy file conflict; retrying that isolated job.

[github-actions]

✗ togi mutation report

40.0% mutation score — 8/20 killed, 0 survived, 12 timeout, 0 build errors — 532.53s