fix(cpg): a batch goes through a file, not the command line

Scanning a 637-file WordPress plugin reported 500 regions examined, zero
findings, and a taint query time of **0.05 seconds** -- less than a JVM
takes to start. Dominance ran for 29.56s and config for 22.44s in the same
scan, so only taint had failed.

Linux caps a SINGLE argument at MAX_ARG_STRLEN (128KB) whatever ARG_MAX
says. Measured on that plugin:

  taint      2500 requests   1.49 MB   <- over the cap
  dominance    13 requests   0.04 MB
  config       13 requests   0.00 MB

As `--param requests=<json>` execve returned E2BIG, `_run` caught the
OSError, `query_batch` returned {} -- and {} reads as "no rows found". Only
taint crossed the cap, which is exactly why the failure looked like a
result rather than an error.

This is the quiet failure the rung ladder cannot catch. Every other honesty
mechanism in this codebase labels a verdict; here no verdict was produced
to label, and a scan of a vulnerable plugin reported it clean.

The payload is now staged to a file beside the CPG and the path is passed
instead; all three queries read `requestsFile` when it is set and keep
`requests` for the single-request forms and the tests. A test asserts no
argument approaches the cap, since the failure mode is invisible at the
scale the unit tests run at -- batching worked on every small tree it was
ever tried on.

Verified on vampi first: 4 entailed, unchanged, all three known
vulnerabilities still found.

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/cpg/queries/config.sc

@@ -14,9 +14,23 @@
 
 // BATCHED, like taint.sc. Single-request form kept for the committed measurements.
 
-@main def exec(cpgFile: String, settings: String = "", function: String = "", file: String = "", requests: String = "") = {
+@main def exec(
+    cpgFile: String,
+    settings: String = "",
+    function: String = "",
+    file: String = "",
+    requests: String = "",
+    requestsFile: String = ""
+) = {
   importCpg(cpgFile)
 
+  // The batch arrives as a FILE. A single command-line argument is capped at 128KB on Linux and a
+  // repository's requests are megabytes, so passing them as `--param requests=` failed with E2BIG and the
+  // driver read the empty result as "no rows". `requests` is kept for the single-request forms and the tests.
+  val requestsJson =
+    if (requestsFile.nonEmpty) scala.io.Source.fromFile(requestsFile).mkString
+    else requests
+
   def split(raw: String): List[String] = raw.split(",").map(_.trim).filter(_.nonEmpty).toList
 
   def rowsFor(settingsS: String, functionS: String, fileS: String): List[ujson.Obj] = {
@@ -53,8 +67,8 @@
   }
 
   println("---OUSAST-CPG-BEGIN---")
-  if (requests.nonEmpty) {
-    val parsed = ujson.read(requests).obj
+  if (requestsJson.nonEmpty) {
+    val parsed = ujson.read(requestsJson).obj
     val answers = parsed.map { case (id, req) =>
       def field(name: String): String = req.obj.get(name).map(_.str).getOrElse("")
       id -> ujson.Arr(rowsFor(field("settings"), field("function"), field("file")): _*)

src/openultrasast/cpg/queries/dominance.sc

@@ -42,10 +42,18 @@
     file: String = "",
     operationRequires: String = "",
     dischargersByKind: String = "",
-    requests: String = ""
+    requests: String = "",
+    requestsFile: String = ""
 ) = {
   importCpg(cpgFile)
 
+  // The batch arrives as a FILE. A single command-line argument is capped at 128KB on Linux and a
+  // repository's requests are megabytes, so passing them as `--param requests=` failed with E2BIG and the
+  // driver read the empty result as "no rows". `requests` is kept for the single-request forms and the tests.
+  val requestsJson =
+    if (requestsFile.nonEmpty) scala.io.Source.fromFile(requestsFile).mkString
+    else requests
+
   def split(raw: String): List[String] = raw.split(",").map(_.trim).filter(_.nonEmpty).toList
 
   def parseMap(raw: String): Map[String, List[String]] =
@@ -162,8 +170,8 @@
   }
 
   println("---OUSAST-CPG-BEGIN---")
-  if (requests.nonEmpty) {
-    val parsed = ujson.read(requests).obj
+  if (requestsJson.nonEmpty) {
+    val parsed = ujson.read(requestsJson).obj
     val answers = parsed.map { case (id, req) =>
       def field(name: String): String = req.obj.get(name).map(_.str).getOrElse("")
       id -> ujson.Arr(

src/openultrasast/cpg/queries/taint.sc

@@ -48,10 +48,18 @@
     callDepth: String = "0",
     boundedSinks: String = "",
     parameterSources: String = "false",
-    requests: String = ""
+    requests: String = "",
+    requestsFile: String = ""
 ) = {
   importCpg(cpgFile)
 
+  // The batch arrives as a FILE. A single command-line argument is capped at 128KB on Linux and a
+  // repository's requests are megabytes, so passing them as `--param requests=` failed with E2BIG and the
+  // driver read the empty result as "no rows". `requests` is kept for the single-request forms and the tests.
+  val requestsJson =
+    if (requestsFile.nonEmpty) scala.io.Source.fromFile(requestsFile).mkString
+    else requests
+
   def split(raw: String): List[String] = raw.split(",").map(_.trim).filter(_.nonEmpty).toList
 
   def rowsFor(
@@ -254,8 +262,8 @@
   }
 
   println("---OUSAST-CPG-BEGIN---")
-  if (requests.nonEmpty) {
-    val parsed = ujson.read(requests).obj
+  if (requestsJson.nonEmpty) {
+    val parsed = ujson.read(requestsJson).obj
     val answers = parsed.map { case (id, req) =>
       def field(name: String): String = req.obj.get(name).map(_.str).getOrElse("")
       val paramSrc = req.obj.get("parameterSources").map(_.str).getOrElse("false")