Fix: [for cherry-picking] Updated body-policy filtering to distinguish

[qodo-code-review]

Fixed Findings

• Fail closed on allowlist filter errors

Automated fix from agentic review of #56

---

Note

Fail closed on ripgrep errors in body-policy.sh filtering pipeline

The check function in body-policy.sh previously used || true to suppress all non-zero ripgrep exit codes during allowlist and control-reference filtering, meaning ripgrep errors were silently ignored.

• Splits the single filter pipeline into two explicit steps, each capturing ripgrep's exit code in filter_rc
• Exits with an error annotation (exit 2) if ripgrep returns exit code ≥ 2 at either step
• Behavioral Change: scans that previously completed silently despite ripgrep errors will now fail closed with an explicit error

^{Macroscope summarized e129971.}

[greptile-apps]

PR author is in the excluded authors list.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in e129971. This PR modifies a security guard script (public-repo-guard) with behavioral changes to error handling. The author does not own this file, and changes to security-related CI controls should be reviewed by the designated code owners (wave-av/sdk-owners).

^{You can customize Macroscope's approvability policy. Learn more.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.