properly scope file_writes policy

file_writes policy has a global scope and an even filter:

```yaml
scope:
- global
rules:
- event: security_file_open
filter:
- args.pathname=$WORKSPACE
```

could this be improved to reduce the scope of the trace before filtering the event?

Locate the file_writes policy configuration and trace how its global scope and event filter are evaluated. Compare the current scoping and filtering behavior, then verify that the trace is narrowed before security_file_open events are filtered for $WORKSPACE.

Written by the indexing model from the issue text.