test(integration): document mapping[0]=DR55 dependency on dest_host helper

Follow-up to 38fa352 (QA finding: scope-narrative-inaccuracy).

The 38fa352 commit message claimed lookups/rule_csv_map.csv was
"reduced from 9 mappings to 1" — that was wrong. Per commit 301dcd5
("trim demo CSVs from 19 to 3"), the file actually contains 3
mappings:

  DR55_brute_force_login -> DR55_brute_force_users.csv  (mapping[0])
  DR55_brute_force_login -> DR55_brute_force_src.csv    (mapping[1])
  DR130_privilege_escalation -> DR130_priv_escalation.csv (mapping[2])

The fix in 38fa352 still works because mapping[0] (file-order-wise)
is the DR55 users CSV, which has `dest_host` but lacks plain `host`.
But the reasoning chain in the original commit message implied only
one mapping survived — that was wrong, and a future maintainer reading
the commit could be misled into thinking the test would be safe for
any mapping[0].

This commit adds an inline docstring to the _submit_column_removal
helper documenting:
  (a) the dependency on mapping[0] being DR55 users
  (b) why "dest_host" was chosen (lives in that CSV's schema)
  (c) the other two mappings have INCOMPATIBLE schemas — if file
      reorder changes mapping[0], this helper will break

A stronger fix would parameterize the column choice from the actual
CSV header instead of hardcoding. Deferred — current state is
deterministic and tests pass; the docstring is sufficient guard
against silent breakage.

Lesson logged in ~/.claude/state/qa-findings.jsonl as
"scope-narrative-inaccuracy": don't infer file contents from
`head -2 *.csv | head -20` output — the outer head limit truncates;
verify SOT with `cat`.

Author: RelativisticJet

tests/integration/test_post_happy_paths.py

@@ -456,7 +456,22 @@ def test_save_csv_response_shape_for_small_edit(
 
 def _submit_column_removal(container_curl, csv_file, rule_name):
     """Helper — submit a column_removal approval request and
-    return the parsed body."""
+    return the parsed body.
+
+    NOTE on the hardcoded "dest_host" column: callers in this suite
+    pass mapping[0] from get_mapping, which (per the current file
+    order in lookups/rule_csv_map.csv) is DR55_brute_force_users.csv.
+    Its data columns are: user, src_ip, dest_host, threshold,
+    auth_method. We pick "dest_host" so the approval can succeed at
+    replay time. If you reorder rule_csv_map.csv or change mapping[0]
+    to a CSV with a different schema, this helper (and the inline
+    test_approve_response_shape_for_column_removal below) must be
+    re-checked. Two other mappings in the current demo state —
+    DR55_brute_force_src.csv (cols: src_ip, src_host, Comment) and
+    DR130_priv_escalation.csv (cols: user, target_group, host, ...) —
+    have DIFFERENT schemas, so this helper would error if mapping[0]
+    became either of those.
+    """
     payload = {
         "approval_action_type": "column_removal",
         "csv_file": csv_file,