fix(scanner): detect multiline unbounded retry loops

[rksharma-owg]

Fixes #21

Summary

• add an opt-in multiline rule field and pass --multiline to ripgrep for those rules
• update P17.6 to detect ordinary multiline while True LLM retry loops as a low-confidence warning
• exclude nearby break, timeout, and max_retries bounds
• synchronize the JSON and Semgrep exports and add positive/negative fixture coverage

Problem and root cause

P17.6 contained a dotall pattern, but the scanner still invoked ripgrep in line-oriented mode. As a result, the rule missed typical Python loops where while True and chat(), complete(), or generate() are on separate lines. Its metadata also emitted fail/medium even though this deliberately heuristic rule is specified as warn/low.

The new rule-level flag keeps multiline scanning opt-in. A zero-width lookahead lets P17.6 inspect the loop body while pinning the finding to the while True line.

DSGAI mapping

• DSGAI17 — Resource Consumption Controls
• Rule P17.6 — unbounded LLM retry loop heuristic

Tests added

• positive multiline unbounded retry fixture
• negative fixtures for an explicit break, timeout, and retry limit
• rule metadata regression assertion and line-pinned expected finding

Validation

• /tmp/dsgai-issue21-venv/bin/python -m pytest tests/test_runner.py -q -p no:cacheprovider — 28 passed, 1 skipped (the opt-in live OSV test)
• rules JSON, Semgrep export, prompt variant, and expected-findings --check commands — all synchronized
• ruleset schema, generated checkpoint schema, and SARIF assertions — passed
• fixture scan — exactly one P17.6 finding: unbounded_retry.py:5, status warn (scanner exit 1 is expected for fixture findings)
• yamllint, ShellCheck, Markdown link check, compileall, and git diff --check — passed

Checklist

• Data is anonymized (no PII, credentials, or org names)
• Entries reference at least one DSGAI ID where applicable
• Scanner validation and CI-equivalent checks pass
• One entry per file for dataset contributions (not applicable; no dataset entries)

AI assistance

AI assistance was used during the audit and test drafting. I reproduced the issue against the real CLI and independently reviewed and ran every submitted change.