fix(OSQUERY-001): CU-86akbhhc0 7 review findings across 4 files

[flamingo]

Closes 7 review findings across 4 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 95 high	openframe_encryption_service.h missing required osquery copyright/SPDX header	openframe/openframe_encryption_service.h:1
2	🟢 90 high	OpenframeEncryptionService class defined outside the osquery namespace	openframe/openframe_encryption_service.h:11
3	🟡 70 medium	decrypt() documented to throw std::runtime_error instead of returning Status	openframe/openframe_encryption_service.h:16
4	🟢 90 high	Encryption size constants use ALL_CAPS instead of the kPascalCase convention	openframe/openframe_encryption_service.h:27
5	🟢 95 high	openframe_token_refresher.h missing the standard osquery copyright/SPDX header	openframe/openframe_token_refresher.h:1
6	🟢 95 high	openframe_token_refresher.cpp missing standard osquery copyright/SPDX header	openframe/openframe_token_refresher.cpp:1
7	🔴 45 low — review closely	extended_attributes.cpp test file body is entirely commented out with no real validation	tests/integration/tables/extended_attributes.cpp:25

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: b32b188b-c173-4bd3-b45f-183899f8b1b1

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhc0 osquery table and process handling fixes (10 PRs)