Robust handling of audit log file rotation (#22925)

* Change fetch_audit_logs to accept multiple file paths

auditreduce natively accepts multiple files and merges them
chronologically, so accept list[str] and join paths in the command.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Restructure collect_data_from_files for batched processing

Replace the per-file subprocess loop with a two-phase approach:
1. Filter phase: collect valid file paths (skip missing/out-of-range/
   already-processed files)
2. Single fetch: call fetch_audit_logs once with all valid paths

This fixes the file_index bug where skipped files incremented the index
causing incorrect time filters on subsequent files, and reduces the
TOCTOU window for not_terminated files rotating before being reached.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Modernize type annotations in check.py

Remove typing.List/Tuple imports, use built-in lowercase types.
Update collect_relevant_files and get_previous_iteration_log_cursor
return types to modern syntax.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Clean up inline comments in check.py

Remove verbose inline comments per coding guidelines. Code is
self-explanatory through descriptive variable and method names.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* changelog

* implement feedback

* adjust cursor structure for batching

* address review feedback

- fetch_audit_logs: return output, error on the exception path and guard
  finally so a Popen failure does not raise UnboundLocalError; terminate
  with a wait+kill fallback so children cannot outlive the check
- drop shell=True in favour of argv lists to avoid path injection
- log a debug line when collect_data_from_files has no valid paths
- add missing @pytest.mark.unit markers
- cover crash_recovery before-cutoff branch and clean-resume same-second
  scenario
- reword first changelog entry to action-tense

* fix mid-ingestion cursor bug

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: iliakur

mac_audit_logs/changelog.d/22925.fixed

@@ -0,0 +1 @@
+Batch audit log files into a single auditreduce invocation so the check keeps up with frequent file rotation.