fix(adhoc-sweep-fixes): CU-86akbhhtv 40 review findings across 40 files

[flamingo]

Closes 40 review findings across 40 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🔴 45 low — review closely	Regex-based uninstall script migration silently skips scripts that don't match the exact expected pattern, potentially leaving stale/broken uninstall scripts	server/datastore/mysql/migrations/tables/20241002104104_UpdateUninstallScript.go:102
2	🔴 55 low — review closely	Timestamp backfill in vpp_apps_teams migration may silently set wrong created_at when multiple teams share the same adam_id/platform	server/datastore/mysql/migrations/tables/20250219100000_AddVPPAppsTeamsTimestamps.go:26
3	🔴 40 low — review closely	Destructive RENAME TABLE migration has no rollback and no compatibility shim for in-flight code	server/datastore/mysql/migrations/tables/20260316120008_RenameActivitiesToActivityPast.go:12
4	🔴 35 low — review closely	Name-sync migration overwrites software_titles.name/software.name irreversibly with a no-op Down migration and no backup	server/datastore/mysql/migrations/tables/20260326210603_UpdateSoftwareTitleNamesToFMANames.go:20
5	🟡 80 medium	Bitwise-encoded sample byte in encoding_type test comment does not match asserted host IDs	server/datastore/mysql/migrations/tables/20260518194422_AddEncodingTypeToHostSCDData_test.go:17
6	🔴 35 low — review closely	PoliciesByID mixed-batch behavior may mask legitimate partial results for non-multitenant callers	server/datastore/mysql/policies_queries_openframe_test.go:78
7	🔴 45 low — review closely	S3 store constructors duplicate the 'reuse software installer S3 config' pattern without shared helper	server/datastore/s3/bootstrap_package.go:12
8	🟡 80 medium	Bolt depot tests use panic() for setup failures and share process-wide temp DB state without cleanup	server/mdm/scep/depot/bolt/depot_test.go:14
9	🟢 90 high	TruncateTables swallows individual table truncation context but not overall failure context	server/platform/mysql/testing_utils/testing_utils.go:74
10	🟡 70 medium	makeDefaultTeamConfigCache caches a permanent error result with no retry/expiry	server/policies/failing_policies.go:243
11	🟡 80 medium	RecordPolicyQueryExecutions/RecordLabelQueryExecutions mutate the passed-in host's timestamp even on the sync path before persistence, coupling caller state to datastore success	server/service/async/async_policy.go:32
12	🟡 70 medium	TestAuthenticatedDeviceFallbackAuth does not assert HostByUUID/token func call ordering, masking a potential auth-fallback ordering bug	server/service/devices_url_auth_test.go:45
13	🟡 85 medium	CreateSecretVariables mutates caller-provided slice in place via index assignment	server/service/secret_variables.go:45
14	🔴 55 low — review closely	SoftwareByID relaxes team-based host visibility restriction to return metadata stubs, contradicting the AuthzSoftwareInventory check just performed	server/service/software.go:192
15	🟡 85 medium	nodeMatcher falls through to OR on unknown operator without failing, silently mis-evaluating AND/OR CPE logic trees	server/vulnerabilities/nvd/tools/cvefeed/nvd/match_node.go:54
16	🟡 85 medium	ObjectStateSimpleValue.unpack panics on malformed input with fewer than 3 pipe-separated segments	server/vulnerabilities/oval/parsed/object_state_simple_value.go:29
17	🟡 65 medium	runProfileDeleted logs 'run profile deleted' info messages but reuses runProfileChanged's cooldown/no-devices log wording inconsistently across the two nearly-identical functions	server/worker/macos_setup_assistant.go:87
18	🟡 80 medium	insertSoftware silently drops rows with fewer than 3 CSV columns without counting/reporting them	tools/dibble/pkg/seed/vulns.go:178
19	🔴 30 low — review closely	Fleet slackbot system prompt duplicates and risks drifting from the same tool-usage guidance elsewhere	tools/fleet-slackbot/system-prompt.js:76
20	🔴 45 low — review closely	RunCommandAndReturnOutput executes shell strings via bash -c with no input sanitization	tools/github-manage/pkg/ghapi/cli.go:11
21	🔴 55 low — review closely	Hardcoded default MySQL credentials in debugging tool main.go	tools/mdm/apple/apnspush/main.go:56
22	🔴 55 low — review closely	seed_queries.go leaves FOREIGN_KEY_CHECKS disabled on early Fatal exit	tools/seed_data/queries/seed_queries.go:58
23	🔴 55 low — review closely	Unreachable email-verification code path guarded by an always-thrown Error, leaving stale commented-out logic in production controller	website/api/controllers/account/update-profile.js:155
24	🔴 55 low — review closely	Android enterprise service account private key logged via util.inspect on generic error path	website/api/controllers/android-proxy/create-enterprise-webapp.js:108
25	🔴 55 low — review closely	Sensitive tenant provisioning API response bodies logged unconditionally to info level for one hardcoded instance	website/api/controllers/microsoft-proxy/receive-redirect-from-microsoft.js:100
26	🔴 55 low — review closely	Unbounded polling loop for sandbox health check has no real timeout despite comment claiming a limit	website/api/helpers/fleet-sandbox-cloud-provisioner/provision-new-fleet-sandbox-instance.js:93
27	🟡 75 medium	Shared secret comparison for MS-API-KEY not constant-time	website/api/policies/is-cloud-customer.js:14
28	🟡 80 medium	Salesforce sync helper logs full error object (require('util').inspect(err)) which may include PII from user records	website/scripts/send-trial-usage-information-to-crm.js:95
29	🔴 55 low — review closely	Windows package signing action passes secrets to a third-party composite action without pinning it to a commit SHA	.github/steps/sign-windows-package/action.yml:42
30	🔴 30 low — review closely	sync-upstream workflow force-pushes a branch built from an unauthenticated merge of an external repo with no review gate before PR creation	.github/workflows/sync-upstream.yml:32
31	🔴 55 low — review closely	KeystoreManager test-mode flag is a package-level mutable global with no thread-safety guard	android/app/src/main/java/com/fleetdm/agent/KeystoreManager.kt:19
32	🔴 55 low — review closely	initMailService swallows mail service construction failure and returns a nil service silently to callers	cmd/fleet/mail.go:33
33	🟡 85 medium	date -v-1d is macOS/BSD-only and will silently fall through to GNU date via ||, but with fragile error suppression	cmd/osv-processor/sync-and-detect-changes.sh:88
34	🔴 55 low — review closely	CIS_6.1.1.sh still contains a literal placeholder never substituted at runtime	ee/cis/macos-14/test/scripts/CIS_6.1.1.sh:1
35	🔴 55 low — review closely	Hardcoded session secret placeholder committed to config	ee/fleet-agent-downloader/config/session.js:21
36	🟡 85 medium	microsoft-edge-install.sh backup-cleanup uses a broad find + rm -rf across entire /tmp, /var/folders trees on every install	ee/maintained-apps/inputs/homebrew/scripts/microsoft-edge-install.sh:54
37	🟡 75 medium	TPM parent key handle leaked on error path in LoadKey/CreateKey helper duplication	ee/orbit/pkg/securehw/securehw_tpm.go:59
38	🔴 55 low — review closely	MDM asset creation ignores partial-not-found error without validating expected asset count	ee/server/service/condaccess/config.go:21
39	🔴 45 low — review closely	linux_lock.sh reboot scheduling silently no-ops if systemd-run is unavailable, leaving the system in an inconsistent locked state	ee/server/service/embedded_scripts/linux_lock.sh:113
40	🔴 45 low — review closely	ClickableUrls regex-based URL detection can be tricked into rendering unintended href targets	frontend/components/ClickableUrls/ClickableUrls.tsx:12

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 3ba0fd37-c226-436b-ba81-b544a7d0a515

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhtv FleetMDM bulk review findings sweep (10 PRs)