fix(FLEETMDM-009): CU-86akj32d7 2 review findings across 2 files

[flamingo]

Closes 2 review findings across 2 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 90 high	CiscoJabberVersionTransformer overrides InstallerURL implicitly via version mismatch without resetting SHA256	ee/maintained-apps/ingesters/homebrew/external_refs/cisco_jabber_version_transformer.go:7
2	🟡 85 medium	Verify grammarly-desktop-install.sh script correctness — unattended sudo cp of directory contents lacks error checking on mount	ee/maintained-apps/inputs/homebrew/scripts/grammarly-desktop-install.sh:47

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 1446a072-096e-4294-8082-c7cadffe76de

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akj32d7 FleetMDM bulk review findings sweep (12 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff.

[flamingo]

🦩 🔴 CiscoJabberVersionTransformer overrides InstallerURL implicitly via version mismatch without resetting SHA256

Changed the hardcoded app.Version literal in CiscoJabberVersionTransformer (cisco_jabber_version_transformer.go) from "15.2.1" to "15.2.0" to match the documented value and what osquery reports, fixing the version mismatch. SHA256 is not set or modified anywhere in this transformer (no field is touched besides Version), so there is no stale SHA256 to reset in this file; a full verification of SHA256 consistency would require checking the manifest-building pipeline outside this file, which is out of scope for this single-file fix.

🤖 Prompt for AI agents

In ee/maintained-apps/ingesters/homebrew/external_refs/cisco_jabber_version_transformer.go around line 7, review and complete this code-review fix: CiscoJabberVersionTransformer overrides InstallerURL implicitly via version mismatch without resetting SHA256.
What the draft fix changed: Changed the hardcoded `app.Version` literal in `CiscoJabberVersionTransformer` (cisco_jabber_version_transformer.go) from "15.2.1" to "15.2.0" to match the documented value and what osquery reports, fixing the version mismatch. SHA256 is not set or modified anywhere in this transformer (no field is touched besides Version), so there is no stale SHA256 to reset in this file; a full verification of SHA256 consistency would require checking the manifest-building pipeline outside this file, which is out of scope for this single-file fix.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 Verify grammarly-desktop-install.sh script correctness — unattended sudo cp of directory contents lacks error checking on mount

In the "extract contents" section, hdiutil attach is now checked with an if ! guard that echoes an error and exits 1 on mount failure, and a follow-up check verifies $MOUNT_POINT is non-empty (via ls -A) before the sudo cp -R runs, detaching the mount point and exiting 1 with a diagnostic message if the mount produced no files. This differentiates mount failures/empty mounts from the later "Grammarly Installer.app not found" error path, as requested.

🤖 Prompt for AI agents

In ee/maintained-apps/inputs/homebrew/scripts/grammarly-desktop-install.sh around line 47, review and complete this code-review fix: Verify grammarly-desktop-install.sh script correctness — unattended sudo cp of directory contents lacks error checking on mount.
What the draft fix changed: In the "extract contents" section, `hdiutil attach` is now checked with an `if !` guard that echoes an error and exits 1 on mount failure, and a follow-up check verifies `$MOUNT_POINT` is non-empty (via `ls -A`) before the `sudo cp -R` runs, detaching the mount point and exiting 1 with a diagnostic message if the mount produced no files. This differentiates mount failures/empty mounts from the later "Grammarly Installer.app not found" error path, as requested.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer