[N0ahTM]

Problem

CodeQL reported a successful run while GitHub received an empty SARIF analysis. The filter also retained findings from generated C++/WinRT files.

Change

• Write filtered SARIF to a separate file before uploading it.
• Count raw and filtered results, compare the filtered count with first-party locations in the raw report, and preserve raw SARIF on failure. A genuinely clean scan can still pass.
• Match URI-encoded Generated%20Files paths and reject output that still contains generated-code locations.

Validation

A workflow-dispatch run on the current filter scanned 172 C++ and 2 C files, found 180 raw results, retained 18 first-party results, and GitHub processed all 18. The results contain 14 intentionally deferred documentation warnings, one long switch, and three previously dismissed test findings; none point into generated files. The final PR CodeQL check is running the additional count comparison. All other PR checks pass.

No release or Store submission is involved.