Fix CLI test suite hanging failures on platforms without O_NOFOLLOW/O_NONBLOCK

[Kaushik2210]

Summary

validate-findings.cjs correctly refuses to process any input when the OS doesn't provide O_NOFOLLOW/O_NONBLOCK (e.g. Windows, where these fs.constants are undefined), rather than opening the file unsafely — that's intentional, documented safe-open behavior.

validate-coverage-ledger.test.cjs already guards its CLI-invoking tests behind a HAS_SAFE_INPUT_OPEN check for exactly this reason. validate-findings.test.cjs defines the same HAS_SAFE_INPUT_OPEN constant and applies it to some of its CLI tests, but 7 CLI tests were missing the guard, so they failed outright (rather than skipping) on any platform lacking those flags:

# tests 34
# pass 22
# fail 7

Fix

Apply the existing { skip: !HAS_SAFE_INPUT_OPEN } guard — already used elsewhere in this same file, and in validate-coverage-ledger.test.cjs — to the 7 tests that were missing it. No behavior change to the validator itself; this only brings the test suite's skip conditions in line with the validator's own documented platform behavior.

Test plan

• node skills/security-audit/validate-findings.test.cjs — 34 tests, 0 failures (was 7 failures before this change)
• node skills/security-audit/validate-coverage-ledger.test.cjs — 31 tests, 0 failures (no regression)

🤖 Generated with Claude Code

[Dharundp6]

Reproduced this independently on Windows before finding your PR — same diagnosis, same counts (22 pass / 7 fail), and the validate-coverage-ledger.test.cjs comparison is the right framing. Agreed the validator behaviour is intentional and shouldn't change.

One gap this leaves, offered in case it's useful: once the guards are in place, the fail-closed path has no test anywhere. Right now it's only "covered" by those 7 tests going red on a platform without the flags, which this PR correctly silences. The inverted guard covers it on exactly the platforms that trigger it:

test("CLI fails closed when the OS cannot open input safely", { skip: HAS_SAFE_INPUT_OPEN }, () => {
  const result = runCli(JSON.stringify(producerShapedFindings()));
  assert.equal(result.status, 1, cliOutput(result));
  assert.match(result.stderr, /OS no-follow and nonblocking input protection is unavailable/);
  assertNoInjectedControlBytes(result.stderr);
});

Passing a valid document is the point — it makes the absent OS protection the only possible reason to reject, so the test can't pass for an unrelated reason. On Windows this gives 23 pass / 0 fail / 12 skip; on Linux and macOS it skips and nothing else changes.

Also worth a look while you're in this file: does not reflect controls from a failed CLI input path (line 429) is unguarded but passes on Windows for the wrong reason — the safe-open check fires before the missing path is ever opened, and its three assertions happen to hold anyway. It never exercises the missing-path branch there.

Happy to open a follow-up PR for either of these after this one lands, or you're welcome to fold them in here.