fix(adhoc-sweep-fixes): CU-86akbhhtv 40 review findings across 40 files

[flamingo]

Closes 40 review findings across 40 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🟢 90 high	sandbox-teleporter.page.js binds onpageshow handler with wrong this context breaking the back-button redirect	website/assets/js/pages/try-fleet/sandbox-teleporter.page.js:23
2	🟢 95 high	isUploading not reset to false on the success path in ApplePushCertSetup.onFileUpload	frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx:28
3	🟢 92 high	director silently continues after failed config retrieval, leaving stale/nil URL cached path unguarded	server/mdm/nanodep/proxy/proxy.go:79
4	🔴 55 low — review closely	Unsanitized string values interpolated directly into GraphQL mutation strings via fmt.Sprintf	tools/github-manage/pkg/ghapi/projects.go:334
5	🟢 95 high	remove_receipt_files builds FULL_INSTALL_LOCATION but doesn't use it in the actual rm commands	ee/maintained-apps/inputs/homebrew/scripts/microsoft_word_uninstall.sh:136
6	🟢 90 high	fmt.Println left in test-server request handler (debug leftover)	ee/server/service/scep/sceptest/sceptest.go:152
7	🔴 55 low — review closely	InfoBanner's unused icon prop is documented as a TODO but drives a CSS class that has no visible effect	frontend/components/InfoBanner/InfoBanner.tsx:23
8	🟢 90 high	AppleBMTermsMessage CTA link text 'Go to AB' is a truncated/unclear abbreviation	frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx:16
9	🟡 85 medium	Entra tenant ID add flow lacks the case-insensitive normalization applied to client IDs	frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AddEntraTenantModal/AddEntraTenantModal.tsx:48
10	🟢 92 high	CommandDetailsModal query fn assumes payload/result are always present before calling atob()	frontend/pages/hosts/components/CommandDetailsModal/CommandDetailsModal.tsx:220
11	🟢 90 high	onFileUpload swallows upload errors from renderFlash but still calls onDone(), losing file selection state on failure inconsistently	frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx:183
12	🟢 90 high	getErrorMessage assumes err.data.errors[0] always exists, will throw on unexpected error shapes	frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/components/BootstrapPackageUploader/helpers.tsx:38
13	🔴 35 low — review closely	getErrorMessage logic duplicated near-verbatim across three sibling helpers.tsx files	frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/helpers.tsx:56
14	🟡 80 medium	showVersions computed from global location instead of the injected location prop, breaking testability/SSR consistency	frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventory.tsx:57
15	🟢 95 high	Dead branch: assigning to unused variable instead of undefined when data is not yet loaded	frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventoryTable/SoftwareInventoryTable.tsx:155
16	🟢 95 high	Windows extension pipe path uses over-escaped literal backslashes producing an invalid named pipe path	orbit/cmd/orbit/shell.go:156
17	🟢 95 high	Migration comment duplicated identically twice in a row (likely copy-paste leftover)	server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go:13
18	🟡 70 medium	Test function name doesn't match the migration's actual (mismatched) timestamp	server/datastore/mysql/migrations/tables/20250731151000_EnforceFileVaultAtLogin_test.go:11
19	🟢 95 high	Test uses require.NoError guard around an err already checked by if-block, causing redundant dead branch	server/datastore/mysql/migrations/tables/20250904091745_AddCertificateAuthoritiesTable_test.go:134
20	🟡 70 medium	feedProducedNoData heuristic can wrongly skip legitimate stale-vulnerability cleanup on hosts with zero matching CPEs	server/vulnerabilities/nvd/cve.go:329
21	🟢 95 high	Error from GetIssuesCreatedSinceWithLabel is logged but execution continues, producing confusing 'No issues retrieved' output	tools/github-manage/cmd/gm/issues_with_historical_label.go:46
22	🟡 65 medium	GetCacheStats reads MapProjectFieldNameToField without holding a lock while other maps use mutexes	tools/github-manage/pkg/ghapi/cache.go:18
23	🔴 40 low — review closely	enroll()/getNodeKeyOrEnroll() race: enrollmentMutex is declared but never acquired around the enroll/store sequence	android/app/src/main/java/com/fleetdm/agent/ApiClient.kt:83
24	🔴 55 low — review closely	android/settings.gradle.kts uses placeholder project name 'My Application'	android/settings.gradle.kts:22
25	🟢 97 high	Stats.Log() divides by osqueryEnrollments before any enrollments occur, producing NaN/Inf in error rate	cmd/osquery-perf/osquery_perf/stats.go:276
26	🟢 90 high	os_version.ts swallows the version-format warning without adding it to warningsArray	ee/fleetd-chrome/src/tables/os_version.ts:57
27	🟡 85 medium	Inconsistent error construction: fmt.Errorf vs errors.New for identical empty-version guard across sibling functions	ee/maintained-apps/ingesters/homebrew/external_refs/version_shortener.go:17
28	🟢 92 high	remove_receipt_files builds FULL_INSTALL_LOCATION but then uses a different, unsanitized concatenation for the actual delete commands	ee/maintained-apps/inputs/homebrew/scripts/gpg-suite-uninstall.sh:136
29	🟡 60 medium	initAssets uses context.Background() instead of accepting a caller context	ee/server/service/hostidentity/config.go:12
30	🟢 90 high	Silent date-parse failure in ActivityItem falls back to 'now' instead of surfacing malformed data	frontend/components/ActivityItem/ActivityItem.tsx:95
31	🔴 55 low — review closely	HostPicker test cache-pollution comment documents a real test isolation defect it works around instead of fixing	frontend/components/CommandPalette/components/HostPicker.tests.tsx:108
32	🔴 40 low — review closely	PolicyPicker tests have the same documented QueryClient cache-pollution workaround as HostPicker tests	frontend/components/CommandPalette/components/PolicyPicker.tests.tsx:161
33	🟡 65 medium	List.tests.tsx custom idKey test asserts a tautology instead of verifying idKey behavior	frontend/components/List/List.tests.tsx:110
34	🟢 95 high	Invalid target attribute value '__blank' instead of '_blank' breaks new-tab link behavior	frontend/components/side_panels/QuerySidePanel/EventedTableTag/EventedTableTag.tsx:19
35	🟢 90 high	Indeterminate select-all checkbox logic can produce wrong indeterminate state on filtered/paginated rows	frontend/components/TableContainer/utilities/config_utils.ts:25
36	🟢 90 high	generateResultsCountText silently drops singularization for names ending in a consonant + 's' pattern edge cases and mismatched default export	frontend/components/TableContainer/utilities/TableContainerUtils.ts:31
37	🔴 30 low — review closely	CustomESTForm form-validation module duplicates DigicertForm's validation helper boilerplate almost verbatim	frontend/pages/admin/IntegrationsPage/cards/CertificateAuthorities/components/DigicertForm/helpers.ts:1
38	🟡 85 medium	IntegrationForm createSubmitData mutates jiraIntegrations/zendeskIntegrationSubmitData arrays via splice() on props derived from cache	frontend/pages/admin/IntegrationsPage/cards/Integrations/components/IntegrationForm/IntegrationForm.tsx:110
39	🟡 70 medium	Delete-then-error-swallow flow in DeleteVppModal always calls onCancel on API failure, closing modal silently	frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/DeleteVppModal.tsx:31
40	🔴 45 low — review closely	getErrorMessage helper duplicated near-identically across four modal helper files	frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/helpers.ts:6

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 3ba0fd37-c226-436b-ba81-b544a7d0a515

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhtv FleetMDM bulk review findings sweep (10 PRs)