The gate forked grep twice for every tracked file. On hanzo-inc/platform
(1,286 files) that was 26 s here and 80 s on a forge runner, where every
fork crosses the sandbox (run 16634, Structural invariants), and 45 s on
hanzo-inc/cloud. Each rule now runs once over the whole list and only the
lines it matches are read one at a time: 0.1 s and 0.4 s.
The findings are the same lines: old and new agree on platform, app, ci,
universe (11 findings, exit 1 both), cloud and hanzo.ai, and
certclaims_test.sh passes. grep takes --null, not -Z, which BSD grep
reads as --decompress.
zeekay
a9b8273cec