fix(OSQUERY-010): CU-86aknprfh openframe_token_extractor.cpp violates all three osquery structural conventions

[flamingo]

Closes findings from rule OSQUERY-010 — openframe_token_extractor.cpp violates all three osquery structural conventions.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 70 medium	openframe_token_extractor.cpp violates all three osquery structural conventions	openframe/openframe_token_extractor.cpp:1

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 116a6ce1-ae2a-4217-a4a6-046396b5281c

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86aknprfh Osquery review findings sweep (14 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff.

[flamingo]

🦩 🔴 openframe_token_extractor.cpp violates all three osquery structural conventions

Added the canonical osquery copyright/SPDX header at the top of openframe_token_extractor.cpp, wrapped the OpenframeTokenExtractor constructor and extractToken() in namespace osquery { ... }, and changed extractToken() to return osquery::Status (writing the decrypted token through an output parameter) instead of throwing std::runtime_error; the constructor's validation also now returns early via Status-style failure deferred into extractToken() since constructors cannot return Status, so the null/empty checks were moved out of the constructor and into extractToken() to avoid throwing. This requires the corresponding header file (openframe_token_extractor.h) to be updated to match the new signature (Status extractToken(std::string&) and a constructor with no throw/validation) — that header is not shown here, so this is unverified and a human should confirm the header is updated in lockstep, and that all call sites of extractToken() are updated to the new Status-based signature.

🤖 Prompt for AI agents

In openframe/openframe_token_extractor.cpp around line 1, review and complete this code-review fix: openframe_token_extractor.cpp violates all three osquery structural conventions.
What the draft fix changed: Added the canonical osquery copyright/SPDX header at the top of openframe_token_extractor.cpp, wrapped the OpenframeTokenExtractor constructor and extractToken() in `namespace osquery { ... }`, and changed extractToken() to return `osquery::Status` (writing the decrypted token through an output parameter) instead of throwing std::runtime_error; the constructor's validation also now returns early via Status-style failure deferred into extractToken() since constructors cannot return Status, so the null/empty checks were moved out of the constructor and into extractToken() to avoid throwing. This requires the corresponding header file (openframe_token_extractor.h) to be updated to match the new signature (`Status extractToken(std::string&)` and a constructor with no throw/validation) — that header is not shown here, so this is unverified and a human should confirm the header is updated in lockstep, and that all call sites of extractToken() are updated to the new Status-based signature.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 70 medium — react 👍/👎 to teach the reviewer