Recover the 8 gitleaks rules the converter skips

[aksOps]

Question

What does siloscan need in order to load the 8 gitleaks rules its converter currently skips?

Parent: #48

scripts/convert_gitleaks.py converts 214 of gitleaks v8.30.1's 222 rules. The 8 it skips, and why, verbatim from the converter:

skipped rule	reason
hashicorp-tf-password	path constraint is a regex; siloscan paths are globs
kubernetes-secret-yaml	path constraint is a regex; siloscan paths are globs
nuget-config-password	path constraint is a regex; siloscan paths are globs
pkcs12-file	no regex; path-only rules have no siloscan mapping
pypi-upload-token	compiled regex exceeds the regex crate's default 10 MiB size limit
vault-batch-token	compiled regex exceeds the regex crate's default 10 MiB size limit
(2 further skips)	re-run the converter to enumerate

Three capability gaps behind them, each independently decidable:

1. Regex path constraints. siloscan rules match paths with globs. Supporting a regex path constraint means a new field and a decision about precedence when both are present.
2. Path-only rules. pkcs12-file fires on a filename with no content pattern - a committed keystore is a finding because of what it is. siloscan has no rule shape for "this file existing is the finding". Worth having regardless of gitleaks.
3. Regex size limit. Regex::new defaults to a 10 MiB compiled program. RegexBuilder::size_limit raises it. The question is whether raising it globally is acceptable (compile time, memory) or whether these two rules should be rewritten narrower.

Note the overlap with the rest of this map: kubernetes-secret-yaml and pkcs12-file both target shapes #49 is adding corpus coverage for, and kubernetes-secret-yaml overlaps #52's territory.

Deliverable: a decision per gap, then implementation, then a converter run showing 222 of 222 (or a recorded reason for each remaining skip).

[aksOps]

Resolved by grilling 2026-08-07 (map #48). All eight skips enumerated and dispositioned; this ticket moves up the map order because it carries the k8s answer for #52.

Path-regex rules (5): glob translation in the converter. All five path constraints are trivial extension matches (\.php$, \.(tf|hcl)$, \.ya?ml$, nuget\.config$, \.p(12|fx)$) and all are (?i). A new opt-in case_insensitive boolean on rule path globs (globset supports it natively) preserves exact semantics for every existing user rule; the converter sets it on translated paths. Recovers freemius-secret-key, hashicorp-tf-password, kubernetes-secret-yaml, nuget-config-password - and kubernetes-secret-yaml needs no engine change: the secret engine matches full content, so its (?s:.){0,200} spans work as-is.

Path-only rules (1): walk-layer findings. pkcs12-file becomes a rule shape with a paths glob and no content matcher, evaluated on the walked path list - firing on binary and unreadable files, which is the point for keystores. Span 1:1, no snippet, fingerprint formula unchanged with empty matched text (occurrence 0: one finding per file per rule), severity as the rule declares.

Oversized regexes (3): raise size_limit for pack compilation, measured. Compile time and memory recorded. pypi-upload-token and vault-batch-token import verbatim - vendor rules with no local overlap. generic-api-key stays excluded in favor of generic.yaml's deliberately narrower replacements (see the doc comment in default_pack.rs); re-importing it would double-report everything they overlap. Reason recorded in the converter.

End state: converter reports 221 of 222 converted, 1 skipped with a recorded reason.