fix(OSQUERY-008): CU-86akhf8u2 3 review findings across 3 files

[flamingo]

Closes 3 review findings across 3 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 92 high	EXPECTED_GROUPS_MAX macro violates kPascalCase constant naming convention	osquery/tables/system/user_groups.h:23
2	🔴 40 low — review closely	kControlSettingsFiles / kControlSettingsDirs correctly named but CTL_MAX_VALUE macro breaks the k-prefix constant convention	osquery/tables/system/posix/sysctl_utils.h:19
3	🟢 95 high	File-scope constant kToolType does not follow the constant style but this is a mutable global, not a constant	osquery/utils/info/tool_type.cpp:16

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 39233833-f1d6-416e-93a7-71af15e3e968

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akhf8u2 Osquery review findings sweep (15 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft — 3 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🟠 EXPECTED_GROUPS_MAX macro violates kPascalCase constant naming convention

Replaced #define EXPECTED_GROUPS_MAX 64 with constexpr int kExpectedGroupsMax = 64; and updated all three usages (array bound, ngroups initialization, and the comment) in getGroupsForUser to reference kExpectedGroupsMax, satisfying OSQUERY-008 kPascalCase naming for the constant.

🤖 Prompt for AI agents

In osquery/tables/system/user_groups.h around line 23, review and complete this code-review fix: EXPECTED_GROUPS_MAX macro violates kPascalCase constant naming convention.
What the draft fix changed: Replaced `#define EXPECTED_GROUPS_MAX 64` with `constexpr int kExpectedGroupsMax = 64;` and updated all three usages (array bound, `ngroups` initialization, and the comment) in `getGroupsForUser` to reference `kExpectedGroupsMax`, satisfying OSQUERY-008 kPascalCase naming for the constant.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 kControlSettingsFiles / kControlSettingsDirs correctly named but CTL_MAX_VALUE macro breaks the k-prefix constant convention

Replaced #define CTL_MAX_VALUE 128 with constexpr int kCtlMaxValue = 128; inside the osquery::tables namespace in sysctl_utils.h, per OSQUERY-008 naming convention. Risk: this constant may be referenced by name CTL_MAX_VALUE in system_controls.cpp or platform-specific .cpp files (e.g. linux/darwin implementations) not visible here; if so, those call sites would fail to compile and need to be updated to kCtlMaxValue as well, which is outside this single-file fix's scope.

🤖 Prompt for AI agents

In osquery/tables/system/posix/sysctl_utils.h around line 19, review and complete this code-review fix: kControlSettingsFiles / kControlSettingsDirs correctly named but CTL_MAX_VALUE macro breaks the k-prefix constant convention.
What the draft fix changed: Replaced `#define CTL_MAX_VALUE 128` with `constexpr int kCtlMaxValue = 128;` inside the `osquery::tables` namespace in sysctl_utils.h, per OSQUERY-008 naming convention. Risk: this constant may be referenced by name `CTL_MAX_VALUE` in system_controls.cpp or platform-specific .cpp files (e.g. linux/darwin implementations) not visible here; if so, those call sites would fail to compile and need to be updated to `kCtlMaxValue` as well, which is outside this single-file fix's scope.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 40 low — review closely — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 File-scope constant kToolType does not follow the constant style but this is a mutable global, not a constant

Renamed the mutable global variable kToolType to gToolType in osquery/utils/info/tool_type.cpp, updating its declaration and all usages within setToolType(), getToolType(), isDaemon(), and isShell() to remove the misleading 'k' constant-prefix convention from a variable that is actually mutated.

🤖 Prompt for AI agents

In osquery/utils/info/tool_type.cpp around line 16, review and complete this code-review fix: File-scope constant kToolType does not follow the constant style but this is a mutable global, not a constant.
What the draft fix changed: Renamed the mutable global variable `kToolType` to `gToolType` in `osquery/utils/info/tool_type.cpp`, updating its declaration and all usages within `setToolType()`, `getToolType()`, `isDaemon()`, and `isShell()` to remove the misleading 'k' constant-prefix convention from a variable that is actually mutated.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer