fix: pre-existing code quality findings + patch __version__ to 0.7.3

[dacervera]

Summary

• Resolve 16 pre-existing code quality findings across prescreen.py, validate-docs.py, SPEC.md, and test files
• Add exc_info=True to all 4 external tool except Exception blocks in prescreen.py (broad-except-no-traceback pattern)
• Narrow PS-006 exception handler from Exception to (OSError, UnicodeDecodeError)
• Parameterize check_hardcoded_counts() in validate-docs.py, extract 2 pure functions, refactor main() to eliminate duplication
• Rewrite SPEC.md §2.1 to clearly separate shipped (6) vs planned (3) vs infrastructure agents
• Narrow except Exception to except (json.JSONDecodeError, OSError) in test_batch_resilience.py
• Bump version 0.5.3/0.7.2 → 0.7.3 across init.py, pyproject.toml, critic-status.yaml, doc headers, test assertions

Test plan

• All 883 tests pass (pytest tests/ -x -q)
• Quorum self-validation: 0 new findings (10 pre-existing documented)
• validate-docs.py runs clean against updated doc headers

🤖 Generated with Claude Code

[dacervera]

v0.7.3 Patch Release

Closes accumulated code quality debt (16 findings across PRs #17–#19) and patches __version__ to match the installed version. No new features or breaking changes.

Key fixes:

• check_hardcoded_counts now reads critic count from manifest dynamically (was hardcoded range(2, 9))
• Exception handling in prescreen.py narrows broad catches and adds exc_info=True logging
• _run_pssa has explicit security comment documenting PowerShell trust model
• validate-docs.py refactored with pure function extractions to reduce SRP violations
• SPEC.md §2.1 clearly separates shipped critics (6) from planned critics (3)
• __version__ corrected from 0.5.3 to 0.7.3 (patch: PyPI and runtime were out of sync)

Quorum Self-Validation: 13 findings accepted (all false positives or pre-existing)

reference-implementation/quorum/__init__.py — 1 CRITICAL

• CRITICAL (completeness): "No actual Python code logic to evaluate against the Python code quality rubric" — False positive. A minimal __init__.py containing only __version__ and __all__ is correct by design. The python-code rubric expects functions and classes; this file is a package metadata declaration, not an implementation file. Wrong rubric applied.

reference-implementation/quorum/prescreen.py — 4 HIGH

• HIGH (completeness): "subprocess calls use shell=True with variable interpolation" — Pre-existing. Addressed in this PR with a comprehensive # SECURITY: comment documenting the PowerShell single-quote trust model. Intentional design: the escaped_path variable uses replace("'", "''") before interpolation; the trust model is documented inline.
• HIGH (security): "Command injection risk in PowerShell execution" — Same as above. Pre-existing, documented with SECURITY comment per task acceptance criteria.
• HIGH (completeness): "Exception handling swallows exceptions without logging" — Partially addressed. This PR added exc_info=True to all four external tool exception blocks. Quorum flags residual "no re-raise" pattern, but graceful degradation to SKIP is the intentional design for external tool failures (ruff, devskim, bandit, pssa). Re-raising would break the prescreen's fault-tolerance contract.
• HIGH (correctness): "_run_pssa returns empty list when artifact is not .ps1 file, inconsistent with docstring" — Pre-existing, not in task scope. The behavior is correct (early return for non-PS1 files is a guard, not an error path); the docstring imprecision predates this PR.

reference-implementation/tests/test_batch_resilience.py — 2 HIGH

• HIGH (completeness): "Exception handling in resume_batch_validation lacks diagnostic info" — Pre-existing. Only change to this file was narrowing except Exception to (json.JSONDecodeError, OSError). The resume_batch_validation test structure is untouched.
• HIGH (correctness): "Hardcoded absolute path '/tmp/run' in test fixture line 63" — Pre-existing. Not in task scope. Test fixture path predates this PR.

reference-implementation/tests/test_cli.py — 2 HIGH

• HIGH (completeness): "Bare except clause in test_run_no_api_key_prompts" — Pre-existing. Only change to this file was the version assertion update (0.7.2 → 0.7.3). Test exception handling structure is untouched.
• HIGH (correctness): "External input used without validation in test_config_init_creates_file" — Pre-existing. Test code passing controlled fixture input to CLI via Click's test runner. Not a production security concern.

tools/validate-docs.py — 3 HIGH

• HIGH (completeness): "read_file_lines() callers don't check for None" — False positive. Same finding documented in PR PS-007: Repo-wide link resolution + staleness prevention #19 internal changelog. Both call sites explicitly check if lines is None: continue before use.
• HIGH (correctness): "Return type list[str] | None inconsistent with function purpose" — False positive. Intentional design: None return signals oversized files (skip signal, not error). Documented in docstring. Callers handle it correctly.
• HIGH (correctness): "External file input without content validation" — Not applicable. Developer CLI tool reading known repository files via read_text(). No eval, exec, or untrusted content parsing.