fix(scan): stop the RLS scanner flagging REVOKE/GRANT and CTE reads

[teragrid]

Why

Dogfooding forge scan security on the ai-marketing-platform repo returned
8 findings, all 8 false positives — 7 of them from a single rule,
select-without-where-tenant. A permanently-red gate is exactly the state in
which a real finding goes unnoticed, so this fixes the rule rather than
suppressing the findings.

The two bugs

1. REVOKE / GRANT matched as if they were queries.

REVOKE SELECT ON auth.users FROM authenticated;

The line-local regex select\s+.+\s+from\s+\w+\s*; matches this, because
SELECT and FROM both appear — as a privilege name and a role separator, not
as a query. The scanner was reporting a statement that removes read access
as an unscoped read: hardening reported as exposure, the rule's own meaning
inverted. Two lockdown migrations were flagged this way.

2. Reads of a CTE the same statement just populated.

WITH inserted AS (
  INSERT INTO memberships (...) SELECT ... RETURNING 1
)
SELECT count(*) INTO v_enqueued FROM inserted;

inserted is not a physical table. Tenant scoping belongs on the writing arm;
this read cannot be scoped and leaks nothing. Distinguishing it needs context
beyond the current line, which a line-local scanner does not have.

What changed

RunRLS now scans whole files instead of streaming lines:

• pass 1 collects every CTE name in the file — both WITH x AS ( and the
  continuation form , x AS (
• pass 2 evaluates the rules with that context, and skips any line whose
  leading keyword is GRANT or REVOKE

Supporting changes:

• new scanFilesWhole alongside scanFilesExt, for rules needing file context
• the directory-skip list is extracted into skipScanDir() and shared, rather
  than duplicated into the new walker

Tests

Six new cases. TC-07 is the one that matters most — a false-positive guard
for the fix itself:

Case	Asserts
TC-SCAN-RLS-03	REVOKE SELECT … FROM role; not flagged
TC-SCAN-RLS-04	GRANT SELECT … TO role; not flagged
TC-SCAN-RLS-05	reading a WITH CTE not flagged
TC-SCAN-RLS-06	reading a , x AS ( continuation CTE not flagged
TC-SCAN-RLS-07	a real unscoped read of a physical table in a file that also has a CTE is still flagged — the exemption must not become an off switch for the rule
TC-SCAN-RLS-08	line numbers stay 1-based and correct after moving off bufio line streaming

Second commit — an unrelated red gate found on the way

Pushing this branch was blocked by pre-push stage [13/13], which was already
failing on a clean main: QA-24 and QA-26 run the full ship pipeline
against a forge init --minimal scratch project (no go.mod / package.json,
no cmd/mcp/, no testing-pipeline.md) and assert exit 0. The four-stage
testing gate became blocking by default in 1.8.2 / 1.9.0, so QA-Verify has
correctly failed that project ever since — the gate works, the expectations
were stale.

Both scenarios exist to check that --json bypasses the interactive gate and
emits the documented checkpoints / dry_run keys, not to prove an empty
directory can pass a four-stage testing audit. They now pass
--no-strict-testing, the documented waiver for this case, with a comment
recording why it is required. QA-27 also runs the full pipeline but passes on
its own terms and is left untouched.

Verification

• go test ./internal/cli/cmdscan/ — pass, including the 6 new cases
• go test ./... — 77 packages, no failures
• SHIP_QA_ONLY=1 FORGE_NO_LLM=1 bash scripts/forge-qa-real.sh — 2 of 12
  failing → all 12 passing
• pre-push hook — all 13 stages green
• binary built from this branch, run against ai-marketing-platform:
  findings: 0, status: clean (was 8), and a real unscoped SELECT still
  trips the rule

🤖 Generated with Claude Code