docs(planning): add Phase 0.0 — de-risk Phase 1 via local AppInspect run

Per the 2026-05-13 planning session close-out: rather than committing
to the rest of Phase 0 blind, the next session starts by running
splunk-appinspect locally against the current .spl with both `cloud`
and `splunk-platform-standalone` profiles. This surfaces the
Cloud-cert refactor scope (the single biggest unknown in the plan)
BEFORE we invest in any other Phase 0 work.

If findings are trivial (a few manifest field cleanups), Phase 0
proceeds as planned. If findings reveal multi-week scripted-input
refactoring, the user is notified per D7 escalation policy before
sinking further effort.

30-60 minute exercise; no GitHub Actions involvement; no Splunk
Developer account required (CLI-only check).

Author: wildleo91

docs/PUBLIC_RELEASE_PLAN.md

@@ -62,6 +62,7 @@ CLAUDE.md split. Purely internal; no external dependencies.
 
 | # | Task | Acceptance | Est. |
 |---|------|------------|------|
+| 0.0 | **De-risk Phase 1 FIRST** — install `splunk-appinspect` locally (`pip install splunk-appinspect`), run against the current `.spl` with both `cloud` and `splunk-platform-standalone` profiles, record findings. Decides whether Phase 1 is "trivial" or "multi-week refactor" BEFORE committing the rest of Phase 0. If findings are catastrophic, escalate to user before continuing. | Findings summary written; Phase 1 effort-class estimated | 30-60 min |
 | 0.1 | Fix `validate-and-package.yml` — bump `actions/upload-artifact` v3→v4 | Workflow green on next push | 15 min |
 | 0.2 | Fix `ci.yml` + `integration-tests.yml` pytest/Python mismatch (pytest 9.x requires Python ≥3.10; CI uses 3.9) | Both workflows green. Decision documented: cap pytest at ≤8.4.x OR upgrade workflow Python to 3.10+ | 30 min |
 | 0.3 | Fix `e2e-smoke.yml` Playwright `undefined` env var failure (Windows binary path appears on Linux runner) | Workflow green | 1-2 hr |