docs(planning): revise Phase 0.2 to PARTIAL + add Phase 0.2.1

The QA SubAgent caught my over-claim. Phase 0.2 acceptance was
"Both workflows green" (ci.yml + integration-tests.yml). After the
Python 3.9 → 3.11 bump (1fe4f92) and the test_limits.py fcntl mock
fix (c5c08d1):

  - ci.yml: GREEN — 4/4 jobs (validate, doc-drift, unit-tests,
    js-unit-tests) pass on c5c08d1.
  - integration-tests.yml: STILL RED — 23 fails + 220 errors over
    9 min 24s. The pytest install no longer fails (Phase 0.2's
    target was met) but a large body of pre-existing infrastructure
    debt is now visible: chaos-test docker curl timeouts, KV-state
    pollution between tests, rate-limit state leakage, and one
    Python-version issue (pytest 9 dropped pytest.skip(msg=dict)).

Honest framing: Phase 0.2 as scoped to the mismatch fix is DONE.
"Both workflows green" as the acceptance gate is NOT met because of
unrelated debt. Adding Phase 0.2.1 to capture the integration-tests
remediation as a separate workstream (estimated 4-8 hr based on
failure count + class distribution).

Also caught by QA: my c5c08d1 commit message said "Verified locally"
for the fcntl mock fix. Local Windows skips the fcntl path entirely
(wl_limits.fcntl is None on Windows) so the local pass did not
exercise the bug. The clarification followed in the next sentence
but the framing was sloppy. Logged to qa-findings.jsonl.

E2E Smoke and validate-and-package.yml are also red on c5c08d1 but
those are explicitly Phase 0.3 (Playwright undefined env) and a
Phase 0.1 verification gap (apt-get without sudo) respectively —
out of scope for this commit.

Author: wildleo91

docs/PUBLIC_RELEASE_PLAN.md

@@ -65,7 +65,8 @@ CLAUDE.md split. Purely internal; no external dependencies.
 |---|------|------------|------|
 | 0.0 | **De-risk Phase 1 FIRST** — install `splunk-appinspect` locally (`pip install splunk-appinspect`), run against the current `.spl` with both `cloud` and `splunk-platform-standalone` profiles, record findings. Decides whether Phase 1 is "trivial" or "multi-week refactor" BEFORE committing the rest of Phase 0. If findings are catastrophic, escalate to user before continuing. | Findings summary written; Phase 1 effort-class estimated | 30-60 min |
 | 0.1 ✅ 2026-05-14 (commit 7d4765a) | Fix `validate-and-package.yml` — bump `actions/upload-artifact` v3→v4 (also `actions/checkout` v3→v4 same file; audited all 10 workflows in `.github/workflows/` — none of the other 9 still on v3) | Workflow green on next push | 15 min |
-| 0.2 ✅ 2026-05-14 (commit 1fe4f92) | Fix `ci.yml` + `integration-tests.yml` pytest/Python mismatch (pytest 9.x requires Python ≥3.10; CI uses 3.9). **Resolved: bumped Python 3.9 → 3.11 in 4 places** (ci.yml × 2, integration-tests.yml, release.yml) — chose upgrade-Python over cap-pytest to keep GHSA-6w46-j5rx-g56g closed. All 5 workflows now on 3.11. | Both workflows green. Decision documented: cap pytest at ≤8.4.x OR upgrade workflow Python to 3.10+ | 30 min |
+| 0.2 ⚠️ 2026-05-14 (PARTIAL — see note) | Fix `ci.yml` + `integration-tests.yml` pytest/Python mismatch (pytest 9.x requires Python ≥3.10; CI uses 3.9). **PARTIAL FIX:** bumped Python 3.9 → 3.11 in 4 places (ci.yml × 2, integration-tests.yml, release.yml) in commit `1fe4f92`; fixed 2 unmasked mock bugs in `tests/unit/test_limits.py` in commit `c5c08d1`. **Result on c5c08d1:** `ci.yml` GREEN (4/4 jobs); `integration-tests.yml` STILL FAILING — 23 fails + 220 errors. The integration-tests failures are NOT the Python mismatch alone; the round-7 install failure was masking a large body of pre-existing infrastructure debt: Splunk container 10-s curl-timeout under chaos load, KV-state pollution between tests, rate-limit state leaking across the suite, and one Python-version issue (pytest 9 dropped `pytest.skip(msg=dict)`). These need their own phase — see new Phase 0.2.1. | Both workflows green. Decision documented: cap pytest at ≤8.4.x OR upgrade workflow Python to 3.10+ | 30 min (Phase 0.2 estimate accurate for the mismatch fix itself; 0.2.1 scope much larger) |
+| 0.2.1 | Fix `integration-tests.yml` red — separate from 0.2's Python bump. Triage: (a) `pytest.skip(msg=dict)` → `pytest.skip(reason=str)` migrations (pytest 9 API), (b) chaos-test docker curl timeout 10s → ≥30s for GitHub-Actions runners, (c) container_state fixture KV/sentinel cleanup race (Ring 2 Day 7 work), (d) rate-limit state pollution between RBAC-matrix tests. Acceptance: ≤2 flake-resilient retries, 0 hard failures. | `integration-tests.yml` green on 2 consecutive pushes | 4-8 hr |
 | 0.3 | Fix `e2e-smoke.yml` Playwright `undefined` env var failure (Windows binary path appears on Linux runner) | Workflow green | 1-2 hr |
 | 0.4 | Verify `a11y-audit` / `zap-baseline` / `pip-audit` workflows fire on schedule | At least one successful recent run of each | 10 min |
 | 0.5 | CLAUDE.md 3-bucket migration: extract Decision Log → `docs/DECISION_LOG.md`, Operational Procedures + Disaster Recovery + Rollback → `docs/RUNBOOKS.md`, Splunk Quirks → `docs/SPLUNK_QUIRKS.md` | 3 files exist, cross-references in CLAUDE.md updated, doc-drift hook passes | 2-3 hr |