fix(ci): the Kubescape guard accepts a scan handed to another interpreter #4164

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Found by Spike #3564.

Evidence

Four ways of handing a scan to another interpreter pass scripts/validate-kubescape-frameworks on main (35031dbb), and they also pass the parser-backed prototype the Spike chose. In each case bash runs an nsa-only scan beside the real ksail workload scan --framework nsa,mitre --compliance-threshold 95 line.

Each result was checked against bash with a stand-in ksail that records its arguments.

Audience and problem

Same gate as #3338: a reduced scan can overwrite the uploaded SARIF while the full invocation satisfies the guard. Neither the current reader nor the parser looks inside text that another command later runs as shell.

Direction

Once the guard is parser-backed (#3579), run the same analysis on text handed to bash/sh through a heredoc or here-string, on trap strings, and on input fed to xargs ksail. Where that text cannot be read, refuse it if it names a scan word, the rule bash -c strings already follow.

Acceptance criteria

• All four shapes are refused, each by a test that fails today.
• Controls stay accepted: bash <<'EOF' running echo hello, trap 'rm -f out.txt' EXIT, and the real workflows.
• Every existing test passes unmodified.

Rough size: S.

Generated by Claude Code