Isolating Rule Panics with catch_unwind to Keep Cloud Scans Running

A cloud cost analyzer runs 92 independent rules during each scan, and each rule depends on third-party libraries that could panic on unexpected input. The author argues that Result handles anticipated failures, but panics from unforeseen bugs in dependencies need a separate safeguard. Using std::panic::catch_unwind, each rule's evaluation is wrapped so a panic is logged with its rule and resource IDs and yields no finding, while the scan continues. The approach requires AssertUnwindSafe, justified because the partial state after a panic is discarded rather than read. The technique also depends on panics unwinding, which is disabled under panic = "abort" in release profiles.