Expose matched rule id to action callbacks

[annacai21]

Summary

Action callbacks fired by multi-rule policies (e.g. requirements.bin where multiple rules share one action) couldn't tell which rule actually triggered. This adds rule_id to the node schema, has dd-requirements-converter stamp each rule's stable id on its root node, and exposes the firing rule's id via plcs_eval_ctx_get_matched_rule_id() for action callbacks to read.

Changes

• fbs-schema/nodes.fbs: new rule_id: string on CompositeNode and EvaluatorNode (additive — old buffers read empty, old engines ignore).
• C engine: composite_evaluator captures the depth-0 OR child's rule_id on short-circuit TRUE; exposed via new plcs_eval_ctx_get_matched_rule_id().
• dd-requirements-converter: rule builders take a ruleID arg and stamp it on each rule's root. Deny rules use their JSON id; libc rules synthesize one (e.g. libc_glibc_x64_below_min_2.17.0). Deny rules without an id are rejected.

Follow-ups (out of scope)

• auto_inject's action_allow_deny_injection to read the new accessor (~3 lines).
• Uniqueness validation on rule ids at conversion time.

Test plan

• go test ./... — passes, with new assertions on the rule_id stamped on each top-level OR child
• `make -C c test` pass, including a round-trip test for `matched_rule_id`.

[datadog-prod-us1-3]

 

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

Development | build-libpolicies-linux (gcc, amd64)     

See error

Failed to download archive from GitHub: resource not found at 'https://codeload.github.com/DataDog/junit-upload-github-action/tar.gz/762867566348d59ac9bcf479ebb4ec040db8940a'.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4ab22f5 | Docs | Datadog PR Page | Give us feedback!}