fix(OSQUERY-002-2): CU-86akj32d5 non-Windows bitlocker stubs silently succeed instead of returning Status/error indicating no-op

[flamingo]

Closes findings from rule OSQUERY-002-2 — non-Windows bitlocker stubs silently succeed instead of returning Status/error indicating no-op.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 70 medium	non-Windows bitlocker stubs silently succeed instead of returning Status/error indicating no-op	orbit/pkg/bitlocker/bitlocker_worker_notwindows.go:14

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 1446a072-096e-4294-8082-c7cadffe76de

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akj32d5 Osquery review findings sweep (1 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff.

[flamingo]

🦩 🔴 non-Windows bitlocker stubs silently succeed instead of returning Status/error indicating no-op

Added a package-level ErrNotSupported sentinel error in orbit/pkg/bitlocker/bitlocker_worker_notwindows.go and changed COMWorker.GetEncryptionStatus, COMWorker.EncryptVolume, and COMWorker.RotateRecoveryKey to return it instead of nil, so callers on non-Windows platforms get a distinguishable error rather than silently appearing to succeed. Risk: callers that previously relied on nil, nil being returned unconditionally on non-Windows platforms (if any exist) will now see errors; this could not be verified against all call sites in this single-file fix, so callers may need updates to check for/ignore bitlocker.ErrNotSupported where appropriate.

🤖 Prompt for AI agents

In orbit/pkg/bitlocker/bitlocker_worker_notwindows.go around line 14, review and complete this code-review fix: non-Windows bitlocker stubs silently succeed instead of returning Status/error indicating no-op.
What the draft fix changed: Added a package-level `ErrNotSupported` sentinel error in `orbit/pkg/bitlocker/bitlocker_worker_notwindows.go` and changed `COMWorker.GetEncryptionStatus`, `COMWorker.EncryptVolume`, and `COMWorker.RotateRecoveryKey` to return it instead of `nil`, so callers on non-Windows platforms get a distinguishable error rather than silently appearing to succeed. Risk: callers that previously relied on `nil, nil` being returned unconditionally on non-Windows platforms (if any exist) will now see errors; this could not be verified against all call sites in this single-file fix, so callers may need updates to check for/ignore `bitlocker.ErrNotSupported` where appropriate.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 70 medium — react 👍/👎 to teach the reviewer