docs(appinspect): refine re-eval triggers — separate SLIM allowlist update from action schema change

QA second-pass review of Phase 1.7 closure (commits 628a2b3 + ff9f8be)
flagged that the previous trigger #3 conflated two distinct future
events:

  (a) SLIM's underlying allowlist updates, causing
      check_that_app_passes_slim_validation_for_cloud to start
      passing — at which point set-equality between actual failures
      and expect.yaml keys produces "yaml lists a check that didn't
      fail" and FAILS the workflow until the entry is removed.

  (b) splunk/appinspect-api-action wrapper updates that change the
      expect.yaml file schema itself.

Both are valid triggers but they look for different signals:
  (a) Cloud profile's Report info line shows failure: 0 with this
      file still in place.
  (b) Workflow exits with a YAML parse / schema error.

Split into two numbered triggers and added the observable signal for
(a). Mirrored in both files so the doc and the suppression artifact
agree.

No functional change. Documentation refinement only.

QA-finding class: doc-precision-trigger-conflation.

Author: RelativisticJet

.appinspect_api.expect.yaml

@@ -74,8 +74,17 @@ check_that_app_passes_slim_validation_for_cloud: |
        narrative needs an update.
     2. The first human-reviewer feedback from Splunkbase Cloud Vetting
        — they may tell us the exact manifest format SLIM accepts.
-    3. Any update to `splunk/appinspect-api-action` past v3.0.5 that
-       changes the expect.yaml schema.
+    3. Any SLIM allowlist update that makes
+       `check_that_app_passes_slim_validation_for_cloud` start
+       PASSING again. The action's
+       `compare_against_known_failures` uses set-equality between
+       actual and expected failures, so a spontaneously-passing
+       check creates a yaml-lists-a-failure-that-didn't-occur
+       mismatch and FAILS the workflow until this entry is deleted.
+       Watch for the cloud profile's "Report info" line showing
+       `failure: 0` despite this file existing.
+    4. Any update to `splunk/appinspect-api-action` past v3.0.5
+       that changes the expect.yaml schema itself.
 
   Phase 1.6 dynamic-stage findings record: docs/APPINSPECT_FINDINGS.md
   §5.1 (headline numbers) + §5.2 (per-finding triage).

docs/APPINSPECT_FINDINGS.md

@@ -377,8 +377,16 @@ in the file itself):
    2026-07-18 per CLAUDE.md).
 2. First human-reviewer feedback from Splunkbase Cloud Vetting on
    the actual submission — they may dictate the format SLIM accepts.
-3. Any update to `splunk/appinspect-api-action` past v3.0.5 that
-   alters the expect.yaml schema.
+3. Any SLIM allowlist update that makes
+   `check_that_app_passes_slim_validation_for_cloud` start passing
+   again. The action's `compare_against_known_failures` is
+   set-equality between actual and expected failure names; a
+   spontaneously-passing check produces a "yaml lists a failure
+   that didn't occur" mismatch and FAILS the workflow until this
+   entry is removed. Watch for the cloud profile's `Report info`
+   line showing `failure: 0` while this file still exists.
+4. Any update to `splunk/appinspect-api-action` past v3.0.5 that
+   alters the expect.yaml schema itself.
 
 **Phase 1.8 ("Per-finding triage on warnings + manual_checks") is
 unblocked**: warnings have been triaged unchanged at §3 above