feat(flightcheck): INFRA-002 — verify HR-system reachability from Power Platform's egress boundary

[apurvabanka]

INFRA-002 — Network reachability from Power Platform's outbound boundary

Adds flightcheck INFRA-002, which verifies that the customer's HR-system
endpoint (Workday) is reachable from Power Platform's own outbound service
boundary for the tenant's environment region — the boundary the deployed
agent's connectors actually egress from. A local socket probe can't answer the
firewall/allowlist question; this check can.

How it works

• Live probe (opt-in, consent-gated): temporarily creates a Power Platform
  cloud flow in the tenant's Dataverse environment (region-bound), triggers it
  from PP infra (HEAD request to the target — no credentials, no business data),
  reads reachability, then deletes the flow net-zero.
• Local TCP fallback: if the maker declines consent, or sign-in context /
  permissions / DLP prevent the flow path, the check falls back to a local TCP
  probe from this machine.
• Consent: gated behind an explicit Yes/No prompt in the flightcheck skill
  and the --live-network-probe CLI flag. Default remains the local probe.

Verdict model

PASS iff the target is reachable and resolves to a valid instance. Access /
authorization are intentionally out of scope (connectivity-only).

---

Acceptance Criteria

• AC1: Probes Power Platform outbound IP allowlist for tenant region.
  The live probe issues the request from a flow created in the tenant's
  environment, so egress originates from Power Platform's outbound boundary for
  that environment's region — functionally exercising the customer's allowlist
  rather than reading a static list.
  → flow_probe.run_live_probe + checks/infrastructure.py:check_hr_system_reachability

• AC2: PASS when all current outbound IPs allowed.
  Reachable + valid instance + flow cleaned up → PASSED.
  → _infra_002_from_live (reachable/valid/deleted branch)

• AC3: FAIL when a required outbound IP is blocked.
  Timeout / DNS failure from the PP boundary → FAILED with allowlist
  remediation (Power Platform Admin + Workday Admin roles).
  → _infra_002_from_live (unreachable branch)

• AC4: WARN on partial coverage or unverifiable rules.
  Reachable but the temporary flow could not be auto-deleted (partial/uncertain
  cleanup), or the live path is unavailable and the check degrades to the local
  TCP probe (egress-from-PP unverifiable) → WARNING with cleanup/fallback note.
  → _infra_002_from_live (delete-failed branch) + TCP fallback path

• AC5: 4-field schema per Shared Steps #7433818/#7433819/#7433820.
  Every INFRA-002 result is emitted as a standard CheckResult populating the
  reported schema fields — Status / Result / Remediation / Roles — consistent
  with the referenced Shared Steps.
  → _infra_002_row in checks/infrastructure.py

• AC6: Unit tests: full-allow / partial / blocked / unverifiable / region-mismatch.

  Scenario	Test
  full-allow	TestInfra002FromLive::test_reachable_valid_deleted_passes, TestInfra002CheckLivePath::test_live_success_maps_verdict_and_passes_target, TestInfra002CheckTcpPath::test_tcp_default_pass_notes_local_boundary
  partial	TestInfra002FromLive::test_reachable_valid_but_delete_failed_warns_with_cleanup
  blocked	TestInfra002FromLive::test_unreachable_fails_with_pp_and_workday_roles, TestInfra002CheckTcpPath::test_tcp_default_dns_failure_fails_with_firewall_remediation
  unverifiable	TestInfra002CheckLivePath::test_live_requested_but_no_signin_context_falls_back_to_tcp, test_live_probe_error_falls_back_to_tcp_with_reason
  region-mismatch	TestInfra002FromLive::test_invalid_instance_fails_with_workday_and_maker_roles, TestInfra002CheckLivePath::test_live_invalid_instance_maps_to_fail

---

Changes

• scripts/flightcheck/flow_probe.py (new) — flow lifecycle: build/create/activate/trigger/read/net-zero delete (with retry).
• scripts/flightcheck/checks/infrastructure.py — INFRA-002 check, target resolution, verdict→status mapping; registered in _INFRA_CHECKS.
• scripts/flightcheck/pp_admin_client.py — list_callback_url() for the manual-trigger invoke URL.
• scripts/flightcheck/cli.py — --live-network-probe and --probe-target-url flags + runner wiring.
• src/skills/flightcheck/SKILL.md — consent prompt (Step 1b) and {LIVE_PROBE_FLAG} in run commands (full scope only).
• Tests: 33 new INFRA-002 tests + SAS sig= redaction coverage; tests/captures/_common.py scrubs the callback-URL shared-access secret.
• Recorder + INDEX rows for the validated cassette (tests/captures/record_flightcheck_infra002.py, tests/fixtures/cassettes/INDEX.md).

Target resolution

--probe-target-url override → else Workday connect config
(.local/connect/workday/config.json: baseUrl → restBaseUrl → soapBaseUrl).
No target → SKIPPED.

Testing

python -m pytest tests/flightcheck tests/test_captures_redaction.py -q → all pass.

Follow-up (Phase 2): the validated cassette flightcheck_infra002.yaml
must be captured against a live tenant via the recorder before cassette-backed
flow-path tests are added.