fix(OSQUERY-001): CU-86akhf8u2 kernel_keys integration test performs no validation of query results

[flamingo]

Closes findings from rule OSQUERY-001 — kernel_keys integration test performs no validation of query results.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 70 medium	kernel_keys integration test performs no validation of query results	tests/integration/tables/kernel_keys.cpp:25

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 39233833-f1d6-416e-93a7-71af15e3e968

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akhf8u2 Osquery review findings sweep (15 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff.

[flamingo]

🦩 🔴 kernel_keys integration test performs no validation of query results

In TEST_F(KernelKeys, test_sanity) in tests/integration/tables/kernel_keys.cpp, added a ValidationMap (row_map) with columns "serial_number" (NonEmptyString) and "description" (NormalType) and a call to validate_rows(data, row_map), matching the ValidationMap + validate_rows() pattern from interface_ipv6.cpp/kernel_info.cpp. Risk: the exact column names/types for the kernel_keys table were not visible in the provided material; these were taken directly from the finding's suggested fix, so if the actual table spec uses different column names or types this validation could fail at runtime and would need adjustment against specs/linux/kernel_keys.table.

🤖 Prompt for AI agents

In tests/integration/tables/kernel_keys.cpp around line 25, review and complete this code-review fix: kernel_keys integration test performs no validation of query results.
What the draft fix changed: In TEST_F(KernelKeys, test_sanity) in tests/integration/tables/kernel_keys.cpp, added a ValidationMap (row_map) with columns "serial_number" (NonEmptyString) and "description" (NormalType) and a call to validate_rows(data, row_map), matching the ValidationMap + validate_rows() pattern from interface_ipv6.cpp/kernel_info.cpp. Risk: the exact column names/types for the kernel_keys table were not visible in the provided material; these were taken directly from the finding's suggested fix, so if the actual table spec uses different column names or types this validation could fail at runtime and would need adjustment against specs/linux/kernel_keys.table.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 70 medium — react 👍/👎 to teach the reviewer