ci(appinspect): pin splunk-appinspect==4.2.0 per QA review

Follow-up to `51a26ad`. Phase 1.2/1.3 QA Second-pass review flagged
that `pip install splunk-appinspect` (unpinned) would pull whatever
4.x point release is current at workflow-run time, which lets a
Splunk-side update to AppInspect rules flip the wl_manager gate red
on a Splunk-side change rather than a wl_manager-side change.

Pin to 4.2.0 — the version validated in:
- `.planning/go-public/PHASE_0_0_APPINSPECT_FINDINGS.md` §2 (de-risk
  baseline, 2026-05-13)
- `docs/APPINSPECT_FINDINGS.md` Phase 1.3 baseline (2026-05-17)
- The Python 3.11 pin (Phase 0.0 §2: 3.14 lacks wheels for
  splunk-appinspect 4.2.0's transitive deps pillow + lxml)

Inline comment in the workflow documents the bump procedure: re-run
the Phase 1.3 baseline locally and update both the committed
`*-phase1.json` files and the headline-numbers table in
APPINSPECT_FINDINGS.md in the same commit. That keeps the audit
trail truthful when the pin moves.

Author: RelativisticJet

.github/workflows/appinspect.yml

@@ -65,7 +65,17 @@ jobs:
         run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends libmagic1
 
       - name: Install splunk-appinspect
-        run: pip install --no-cache-dir splunk-appinspect
+        # Pinned to 4.2.0 (the version validated in Phase 0.0 +
+        # Phase 1.3 baselines). Unpinned `pip install splunk-appinspect`
+        # would pull the newest 4.x at workflow-run time, which can
+        # introduce new checks Splunk adds in a point release and
+        # cause the gate to flip red on a Splunk-side change rather
+        # than a wl_manager-side change. When bumping this pin,
+        # re-run the Phase 1.3 baseline locally first and update
+        # `.planning/appinspect/appinspect-*-phase1.json` + the
+        # APPINSPECT_FINDINGS.md headline-numbers table in the
+        # same commit.
+        run: pip install --no-cache-dir splunk-appinspect==4.2.0
 
       - name: Build .spl
         run: bash scripts/package.sh