fix(agent): match bitdefender before defender in providerFromName (#2075)

[ToddHebebrand]

Summary

providerFromName in agent/internal/security/status.go is a first-match substring switch. The defender case preceded the bitdefender case, and "bitdefender" contains the substring "defender", so any Windows Security Center product whose display name contains "Bitdefender" normalized to windows_defender instead of bitdefender — the bitdefender arm was effectively dead code for real Bitdefender names.

This reorders the switch so the more specific bitdefender match wins, mirroring the elastic-before-defender approach. AV coverage counting was unaffected (both are non-other with RTP); this fixes the provider/vendor mislabeling on the security dashboard.

Changes

• Reorder bitdefender case before defender in providerFromName.
• Add agent/internal/security/status_provider_test.go with a table-driven TestProviderFromName that locks in the ordering. The two bitdefender cases fail against the old ordering (verified: providerFromName("Bitdefender") = "windows_defender") and pass with the fix.

Testing

• go test -race ./internal/security/... — green.
• Confirmed the new test is non-vacuous by reverting the ordering: the bitdefender subtests fail with the exact misclassification described in the issue.

Note

PR #2068 (Elastic Defend, fix/2018-elastic-defend-av) also edits this switch and introduces a status_provider_test.go. #2068 is not yet merged to main, so this branched off fresh origin/main (neither the elastic case nor the test file present). The two inserts are independent; whichever merges second will need a trivial rebase to combine both cases and the test tables.

Closes #2075

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	75ba8bf
Status:	⚡️  Build in progress...

View logs

[ToddHebebrand]

Review run: /pr-review-toolkit:review-pr (code-reviewer + pr-test-analyzer — the two applicable to a Go switch-reorder + new table-driven test).
Findings: 0 outstanding. The reorder is the correct fix for the substring-precedence hazard and the new test locks in the ordering.
Tests: go test -race ./internal/security/... green. Confirmed non-vacuous — reverting to the old defender-before-bitdefender ordering fails the two bitdefender subtests with providerFromName("Bitdefender") = "windows_defender", exactly the misclassification in the issue.
Note: PR #2068 (Elastic Defend) also edits this switch and introduces status_provider_test.go; it was not yet merged when this branched off fresh origin/main. The two inserts are independent — a trivial rebase merges both cases and test tables whenever the second one lands.
Status: review-clean, awaiting maintainer merge.