fix: replace .unwrap() with .expect() in non-test scan paths (refs #275)

- semgrep_compat: refactor is_none()+unwrap() to let-else
- semgrep_compat: expect("checked len == 1") on single-positive path
- semgrep_taint: expect on find('.') guarded by prior rfind
- scanner: expect on regex group 0 and Mutex::lock
- terminal: expect on last_mut after push
- foxguard_mcp: expect on json!() serialization

Author: Darkroom4364

src/bin/foxguard_mcp.rs

@@ -190,7 +190,7 @@ fn format_scan_result(result: ScanResult) -> Value {
         "content": [
             {
                 "type": "text",
-                "text": serde_json::to_string(&output).unwrap()
+                "text": serde_json::to_string(&output).expect("json!() is always serializable")
             }
         ]
     })

src/engine/scanner.rs

@@ -343,7 +343,7 @@ fn block_comment_ignore_regex() -> &'static Regex {
 
 fn parse_block_comment_ignore(line: &str) -> Option<(bool, InlineIgnoreSpec)> {
     let captures = block_comment_ignore_regex().captures(line)?;
-    let full_match = captures.get(0).unwrap();
+    let full_match = captures.get(0).expect("group 0 always present");
 
     let mut spec = InlineIgnoreSpec::default();
     match captures.name("rules").map(|rules| rules.as_str().trim()) {
@@ -746,15 +746,15 @@ fn scan_files(
 
             match std::fs::metadata(path) {
                 Ok(m) if m.len() > max_file_size => {
-                    warnings.lock().unwrap().push(format!(
+                    warnings.lock().expect("lock poisoned").push(format!(
                         "warning: skipping {} ({} bytes exceeds --max-file-size)",
                         path.display(),
                         m.len()
                     ));
                     return Vec::new();
                 }
                 Err(_) => {
-                    warnings.lock().unwrap().push(format!(
+                    warnings.lock().expect("lock poisoned").push(format!(
                         "warning: skipping {} (cannot read metadata)",
                         path.display()
                     ));

src/report/terminal.rs

@@ -123,7 +123,7 @@ pub fn print_findings_full(
             current_file = &f.file;
             by_file.push((&f.file, Vec::new()));
         }
-        by_file.last_mut().unwrap().1.push(f);
+        by_file.last_mut().expect("just pushed").1.push(f);
     }
 
     println!();

src/rules/semgrep_compat.rs

@@ -390,10 +390,9 @@ fn match_single_pattern(
     // Find the first meaningful child of the pattern (skip module/program wrapper)
     let pat_node = first_meaningful_node(pat_root, pattern);
 
-    if pat_node.is_none() {
+    let Some(pat_node) = pat_node else {
         return results;
-    }
-    let pat_node = pat_node.unwrap();
+    };
 
     // Walk every node in the target tree and try matching
     walk_and_match(root, source, pat_node, pattern, &mut results);
@@ -890,7 +889,7 @@ fn build_matcher(yaml: &SemgrepRuleYaml) -> Result<PatternMatcher, String> {
         && yaml.pattern_inside.is_none()
         && yaml.pattern_not_inside.is_none()
     {
-        return Ok(positives.into_iter().next().unwrap());
+        return Ok(positives.into_iter().next().expect("checked len == 1"));
     }
 
     if !positives.is_empty() {

src/rules/semgrep_taint.rs

@@ -641,7 +641,7 @@ fn compile_pattern(pattern: &str, role: MatcherRole) -> Option<GenericMatcher> {
         // `root.field` or `root.intermediate.field`. The engine only
         // supports one-level roots, so we take the leftmost segment as
         // the root and the outermost (last) segment as the field.
-        let root = pat[..pat.find('.').unwrap()].to_string();
+        let root = pat[..pat.find('.').expect("rfind guarantees at least one dot")].to_string();
         let field = pat[dot + 1..].to_string();
         if root.is_empty() || field.is_empty() {
             return None;