docs(planning): correct F12 analysis in APPINSPECT_FINDINGS §5.2

QA second-pass review caught an inverted claim in the prior
commit b43915e. F12 was described as "default/app.conf [id] is
missing check_for_updates" but the setting IS present at
app.conf:22 (and redundantly at line 30 in [package]).

The actual SLIM behavior is the same spec-drift class as F2-F11:
the setting exists in the source file but SLIM does not recognize
it in the [id] stanza. SLIM only flags the [id] occurrence; the
[package] occurrence is recognized and silent — meaning [package]
is the canonical home.

Phase 1.7 fix corrected: delete the redundant [id].check_for_updates
line (not add a new setting). The defensive duplication called out
in app.conf:24-27 was over-cautious; per that comment,
check_for_updates_disabled (the AppInspect check) only inspects
[package].

No other §5 claims affected — F1 manifest analysis, F2-F11 spec-drift
analysis, R1.1/D7 escalation assessment, and the §5.3 outcome table
all verified PASS by QA against the actual run output and source files.

Surfaces a useful generalization for Phase 1.7: every "Undefined
setting" line in the SLIM output means "this setting is present but
unrecognized in this stanza", not "this setting is missing". The
remediation is always either suppression (.appinspect_api.expect.yaml)
or relocation (move to the recognized stanza), never insertion.

Author: RelativisticJet

docs/APPINSPECT_FINDINGS.md

@@ -278,12 +278,18 @@ predicted. Two valid remediations for Phase 1.7:
 Option (1) is the intended Phase 1.7 path; option (2) is for the
 roadmap.
 
-**F12 — root cause analysis**: `default/app.conf [id]` is missing
-`check_for_updates`. The setting is optional in static AppInspect but
-SLIM treats its absence as undefined (vs. the explicit
-`check_for_updates = false` Splunk recommends for Cloud apps that
-should not auto-update via the in-product update mechanism). One-line
-fix in Phase 1.7.
+**F12 — root cause analysis**: same spec-drift class as F2–F11, NOT a
+missing-setting bug. `check_for_updates = false` IS present at
+`default/app.conf:22` inside the `[id]` stanza (and again at line 30
+inside `[package]`). SLIM only flags the `[id]` occurrence — the
+`[package]` one is recognized and silent. SLIM's spec doesn't allow
+`check_for_updates` in the `[id]` stanza; the canonical home is
+`[package]` (which we already have). Phase 1.7 fix is to **delete** the
+redundant `[id].check_for_updates = false` line, not add a new
+setting. The defensive duplication referenced by the in-file comment at
+`app.conf:24-27` was over-cautious — `check_for_updates_disabled`
+(the AppInspect check) only inspects `[package]`, per that same
+comment.
 
 ### 5.3 Pre-flagged surfaces — outcome