security(smell-rules): validate ScopeColumn at load time

[jamestexas]

Context

Came out of a /security-review pass over the recently-merged surface area (matrix-e2e harness, testfixtures registry, ADR-0019). The user asked twice in the prior session to make the SQL composition paths injection-safe; this is the one real hardening that came out of the audit.

What it does

SmellRule.ScopeColumn from external $MACHE_SMELL_RULES_DIR JSON files is interpolated unescaped into runSmellRule's SQL ("AND " + rule.ScopeColumn + " = ?" at cmd/smell_findings.go:44). The trust boundary is operator-controlled, so it's not a vulnerability today — but the cost of a load-time whitelist is one regex-shaped check and the value is "a typo or malicious external rule can't smuggle a ;, --, or unexpected characters into the SQL composition path."

Whitelist mirrors the character set the built-in ScopeColumn values actually use (identifiers, ., ,, (, ), ', space) — proven by a test that iterates the registry.

Tests

• TestValidateScopeColumn_AcceptsBuiltinShapes — iterates every built-in rule's ScopeColumn (13 today) and asserts each passes. Future contributors who tighten the whitelist past what real rules need will see this fail before merge.
• TestValidateScopeColumn_RejectsInjectionShapes — covers ;, --, /*, *, =, backtick, ", newline.
• TestLoadExternalSmellRules_RejectsInjectableScopeColumn — end-to-end: a malicious JSON rule with ScopeColumn: "n.source_file; DROP TABLE nodes; --" is rejected by the loader and never reaches runSmellRule.
• TestLoadExternalSmellRules_AcceptsBuiltinShapedScopeColumn — keeps the loader honest about accepting the COALESCE(NULLIF(...)) shape several built-ins use, so the hardening doesn't lock out reasonable external rules.

Broader audit (clean, no other changes)

SQL surface — every Sprintf-built query uses ? placeholders for values; identifier interpolation is either constant or defended via isSimpleIdent; the daemon path (leyline.SocketClient.Query, no placeholders) is escaped via escapeLikePattern (cmd/serve_lsp.go:644). int interpolations are %d (no syntactic injection). loadFiltered's op interpolation is fed only from a 2-value switch over vtab index types.

Hosted-mode HTTP — validateRepoURL already rejects dash-prefix, non-HTTPS, embedded credentials; git clone --depth=1 --single-branch doesn't recurse submodules. SSRF defenses (block loopback / link-local / RFC1918 in ?repo=) are a follow-up I'll file when rsry is reachable again.

Test plan

• task test cmd/ — green (198s)
• pre-commit (gofumpt + vet + golangci-lint) — green