fix(cpg): a batch goes through a file, not the command line

Scanning a 637-file WordPress plugin reported 500 regions examined, zero
findings, and a taint query time of **0.05 seconds** -- less than a JVM
takes to start. Dominance ran for 29.56s and config for 22.44s in the same
scan, so only taint had failed.

Linux caps a SINGLE argument at MAX_ARG_STRLEN (128KB) whatever ARG_MAX
says. Measured on that plugin:

  taint      2500 requests   1.49 MB   <- over the cap
  dominance    13 requests   0.04 MB
  config       13 requests   0.00 MB

As `--param requests=<json>` execve returned E2BIG, `_run` caught the
OSError, `query_batch` returned {} -- and {} reads as "no rows found". Only
taint crossed the cap, which is exactly why the failure looked like a
result rather than an error.

This is the quiet failure the rung ladder cannot catch. Every other honesty
mechanism in this codebase labels a verdict; here no verdict was produced
to label, and a scan of a vulnerable plugin reported it clean.

The payload is now staged to a file beside the CPG and the path is passed
instead; all three queries read `requestsFile` when it is set and keep
`requests` for the single-request forms and the tests. A test asserts no
argument approaches the cap, since the failure mode is invisible at the
scale the unit tests run at -- batching worked on every small tree it was
ever tried on.

Verified on vampi first: 4 entailed, unchanged, all three known
vulnerabilities still found.

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/cpg/backend.py

@@ -189,6 +189,18 @@ class JoernBackend:
             logger.warning("no such cpg query: %s", script)
             return {}
         payload = json.dumps({rid: {k: _render(v) for k, v in req.items()} for rid, req in requests.items()})
+        # Through a FILE, never the command line. Linux caps a single argument at MAX_ARG_STRLEN (128KB)
+        # whatever ARG_MAX says, and a repository blows through that: 2500 taint requests over a 637-file
+        # WordPress plugin is a 1.49MB payload. execve returns E2BIG, `_run` catches the OSError, this returns
+        # {} -- and {} reads as "no rows found". The scan reported 500 regions examined and nothing found, in
+        # 0.05 seconds of taint query, which is a quiet failure of exactly the kind the rung ladder cannot
+        # catch because no verdict was ever produced to label.
+        requests_file = cpg_path.parent / f"{query}-requests.json"
+        try:
+            requests_file.write_text(payload)
+        except OSError as exc:
+            logger.warning("could not stage cpg batch %s: %s", query, exc)
+            return {}
         command = [
             shutil.which("joern") or "joern",
             self._heap_flag(),
@@ -197,7 +209,7 @@ class JoernBackend:
             "--param",
             f"cpgFile={cpg_path}",
             "--param",
-            f"requests={payload}",
+            f"requestsFile={requests_file}",
         ]
         completed = self._run(command, timeout=self.query_timeout, cwd=cpg_path.parent)
         if completed is None or completed.returncode != 0: