feat: automate Splunk Cloud read/write canaries (0.4.0)

[JacobPEvans-personal]

Summary

• Stacked on refactor/api-endpoint-framework after /sync-main from origin/main.
• Cloud stack names stay out of inspect JSON, ACS errors, and CI logs (VCT_SPLUNK_REDACT_TARGET=1); a leak scanner runs on teed pytest output before anything is published.
• Cloud writes remain refused by default. SPLUNK_CLOUD_WRITE=true unlocks ACS create/update/delete for index, role, and hec-token only, still through do_write, --dry-run, and --yes.
• Separate write canary: workflow_dispatch only, typed confirm=WRITE, HEAD subject must start with tests: splunk cloud write. Version bumped to 0.4.0.

Test plan

• Unit: ACS loopback, default write refusal, opt-in dry-run/mocked writes, HEC token redaction
• Human: add GitHub Actions secrets (SPLUNK_URL, SPLUNK_ACS_TOKEN, SPLUNK_ACS_STACK, optional SPLUNK_TOKEN / SPLUNK_ACS_WRITE_TOKEN)
• Dispatch Splunk Cloud Read Canary on this branch; confirm leak scan is clean and the suite is 100% green
• After that green run, record the exact Actions URL as the Cloud read certification
• Write canary only when you type WRITE against a non-production stack

Made with Cursor

[JacobPEvans-personal]

Superseded by a 3-PR stack, split by concern and with every commit signed:

• fix: hide the Splunk Cloud stack name at untrusted output boundaries #83 — Cloud target redaction + CI leak scanner
• feat: gate Splunk Cloud writes behind two explicit opt-ins #84 — Splunk Cloud writes, gated behind SPLUNK_ENABLE_WRITES + SPLUNK_CLOUD_WRITE
• chore: release 0.4.0 #85 (draft) — version bump to 0.4.0