Address review: clean up new-findings temp file, test group ordering

- Remove the new-findings temp file via an EXIT trap (path baked into the
  trap so it survives the local going out of scope under set -u).
- Add a regression test asserting same-(rule,file) findings interleaved with
  another key still group correctly (jq group_by sorts internally, so it is
  order-independent; this guards that guarantee).

Author: picatz

sast/opengrep/scripts/opengrep-report.sh

@@ -553,6 +553,10 @@ main() {
   # New findings = head full scan minus baseline full scan, by stable identity.
   local new_json
   new_json=$(mktemp)
+  # Bake the path into the trap now (double quotes): the EXIT trap fires in the
+  # global scope where this local would be unbound under `set -u`.
+  # shellcheck disable=SC2064  # intentional: expand $new_json at definition time
+  trap "rm -f '$new_json'" EXIT
   compute_new_findings "$baseline_json" "$head_json" "$new_json"
 
   local new_count all_count scanned_count

sast/opengrep/tests/report-diff-test.sh

@@ -80,6 +80,13 @@ expect "second finding same rule+file -> 1 new" 1 1 \
   "$(results_doc "$(finding run.yml 5 'echo a')")" \
   "$(results_doc "$(finding run.yml 5 'echo a')" "$(finding run.yml 50 'echo NEW')")"
 
+# Same-key findings interleaved with another key in the results array must
+# still group correctly (jq's group_by sorts internally; scan output order is
+# not guaranteed). run.yml gains one finding; other.yml is unchanged.
+expect "interleaved same-key findings -> 1 new" 1 1 \
+  "$(results_doc "$(finding run.yml 5 'echo a')" "$(finding other.yml 1 'echo z')")" \
+  "$(results_doc "$(finding run.yml 5 'echo a')" "$(finding other.yml 1 'echo z')" "$(finding run.yml 50 'echo NEW')")"
+
 # Empty baseline (unavailable) -> every head finding is new (conservative).
 expect "empty baseline -> all new" 2 1 \
   '{"results":[],"errors":[],"paths":{}}' \