Apply the executable-match open query to every macOS FMA manifest

[allenhouchins]

Related issue: NA — propagates #52133 to all manifests. Stacked on #52133; merge that first.

What changed

#52133 changes the generated macOS FMA "is app open" query to match only the app's own executable (resolved host-side via apps.bundle_executable) instead of any process inside the app bundle, fixing apps with in-bundle login items or background helpers (1Password, Company Portal, XCreds, …) being permanently reported as open.

This PR applies that template to every existing darwin output manifest instead of waiting for propagation:

• 947 manifests rewritten: the "open" query swapped to the new template, bundle identifier preserved verbatim.
• 14 manifests backfilled: apps frozen before open queries existed (abstract, avast-secure-browser, binance, comet, dbeaver-enterprise, dbeaverlite, dbeaverultimate, disk-drill, evernote, firealpaca, pritunl, visual-paradigm, vnc-viewer, whispering) had no "open" key at all; each gets one, with the bundle identifier verified equal to the input's unique_identifier for all 14.
• 1 already done: 1password/darwin.json was regenerated in Match only the app's own executable in macOS FMA open queries #52133.

Total: 962/962 darwin version entries now carry the new query. Windows outputs are untouched (different template, unchanged).

Why a scripted rewrite instead of go run ./cmd/maintained-apps

• Full regeneration pulls in upstream version bumps for any app whose cask moved, and those bumps would land here without the per-app CI validation the ingest bot's PRs get. This diff is provably queries-only: 961 files, and every changed line is an "open" value (plus the trailing comma added to "patched" in the 14 backfills).
• The ingest job never rewrites frozen outputs, so the 18 frozen apps would otherwise keep the old (or missing) query indefinitely. Hand-editing frozen outputs is the established pattern.

Equivalence to the generator was verified directly: re-running go run ./cmd/maintained-apps -slug <slug>/darwin for slack and intune-company-portal on top of this branch produced byte-identical files.

Sequencing

Merge after #52133. If this merged first, the next scheduled ingestion would regenerate non-frozen manifests with the old template still on main and revert them. Once both are in, the bot's future regenerations produce the same query this PR writes (verified above), so nothing fights.

Reviewer note: existing deployments

software_installers.app_open_query is snapshotted per installer row and refreshes on the FMA version/installer update path. This PR fixes new adds immediately; already-deployed rows pick the query up on their next version bump or re-save. For frozen apps the version never bumps, so deployed rows keep the old behavior until re-saved — same situation as before this PR, minus the fix for fresh installs. A data migration rewriting stored app_open_query values (precedent: 20250121094600_UpdateFMAInstallScripts.go) remains a possible follow-up.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes. _{Carried by Match only the app's own executable in macOS FMA open queries #52133 (changes/fix-macos-fma-open-query), which this PR propagates; a second entry would duplicate the release note.}

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. _{Data-only change; bundle identifiers are preserved verbatim from the existing manifests / inputs.}

Testing

• Added/updated automated tests _{Covered by Match only the app's own executable in macOS FMA open queries #52133's generator tests; this PR is the data those tests generate.}

• QA'd all new/changed functionality manually

• Shape audit before/after: 962/962 darwin version entries match the new template exactly (regex-normalized over the bundle id), zero stragglers, zero missing keys.

• Diff purity: zero changed lines other than "open" values and the 14 "patched" trailing commas.

• Backfill identifiers: all 14 equal the input's unique_identifier (including vnc-viewer, whose patched query carries a second legacy identifier — the open query uses the canonical one, matching what the generator would emit).

• Generator equivalence: regenerating slack/darwin and intune-company-portal/darwin over this branch is a no-op.

• All JSON re-parsed after rewrite; go test ./ee/maintained-apps/... ./cmd/maintained-apps/... ./pkg/patch_policy/... passes.

Semantics of the query itself (real-host audit of 31 installed FMAs, SQLite state matrix, live before/after on Company Portal and XCreds) are QA'd in #52133.