…arity

Four small post-Phase-2 cleanups applied together because they all touch
deploy_bulk.py and overlap.

1. Drop the ::add-mask:: line in acquire_token. The line itself emitted
   the bearer token to stdout before GitHub's mask filter could redact
   it, defeating the purpose. The token is never logged elsewhere, so
   no mask was needed in the first place. Test inverted to assert the
   token does NOT appear in stdout (regression guard).

2. Add POLL_CEILING_SECONDS = 600 and a _parse_retry_after helper that
   handles None, unparseable strings, and clamps to
   [POLL_FLOOR_SECONDS, POLL_CEILING_SECONDS]. Both poll_lro and
   interpret_post_response now use it. Prevents a pathological
   Retry-After value (or unparseable garbage) from either crashing the
   script or sleeping past the global polling timeout.

3. New VariableLibraryConfig nested dataclass replaces the flat
   BulkConfig.variable_library_active_value_set field. The dataclass
   shape now mirrors the YAML structure, and future VariableLibrary
   settings can be added without changing the parent shape.

4. main()'s log output now distinguishes three cases:
   - bulk-parameter.yml missing
   - present but no rules
   - present with N rules
   Cleaner mental model when debugging 'why isn't substitution
   happening?'.

Tests: 173 pass (was 166; +7 for _parse_retry_after happy/clamp/fallback
paths and the new interpret_post_response defensive behavior).

Pure annotation pass. No runtime behavior change; tests pass unchanged.

Adds TypedDict classes to document the shapes the scripts send and
receive from the Fabric REST API. They give Pylance/mypy the
information needed to catch field-name typos and to autocomplete on
response objects. Not enforced at runtime.

scripts/deploy_bulk.py — 4 new TypedDicts:
- DefinitionPart (total): one definitionParts[] element
- ImportItemDetail (partial): one importItemDefinitionsDetails[] entry
- BulkResponseBody (partial): sync 200 / LRO /result body
- LROStatusBody (partial): /v1/operations/{id} poll body
Function signatures updated: partition_dependencies, extract_item_ids,
apply_substitutions, build_definition_parts, check_per_item_status,
interpret_post_response, post_bulk, plus the body local in poll_lro.

scripts/run_fabric_etl.py — 2 new TypedDicts:
- FabricItem (partial): one List Items value[] element
- JobStatusBody (partial): Jobs API status response
Function signatures updated: find_item_id_by_name,
interpret_poll_response, plus the items local in main().

scripts/workspace_swap.py — 1 new TypedDict:
- ItemTypeRegistryEntry (total): one ITEM_TYPES element
Replaces the union-soup annotation
`list[dict[str, str | list[str] | bool | Callable[[str], bool] | None]]`
with a single named type. Highest readability win in this pass.

scripts/deploy_fabric_cicd.py — no changes (delegates to fabric-cicd
library types; no dict shapes worth typing locally).

`headers: dict` annotations left alone in all files — they're loose
CaseInsensitive mappings from requests that don't benefit from
TypedDict.

Verified:
- 173 tests pass (no regressions)
- Zero Pylance errors across all six edited files

Adds the Bulk CI/CD Implementation Guide and updates surrounding docs to
honestly describe what the bulk path does, what it bridges, and what it
doesn't. Closes the documentation gap from Phase 2 (the bulk gap-bridging
work) and the workflow rename earlier on this branch.

New file:
- fabric-bulk-cicd-guide.md (~370 lines) — implementation guide for the
  bulk deploy path. Mirrors the structure of fabric-hybrid-cicd-guide.md
  (architecture, repo structure, deployment flow, workflows,
  configuration strategy, prerequisites, initial deploy, gotchas), with
  bulk-specific sections for the two-deploy decision, extension
  patterns, and limitations not bridged. Self-contained — duplicates
  workspace setup / SPN / GitHub environments rather than linking, so it
  reads end-to-end without bouncing between docs.

Updated docs:
- README.md — new row in the Documentation table for the bulk guide.
- fabric-cicd-release-options.md — bulk row in the comparison table now
  says 'None at the API level' with a note pointer; new note block
  explains substitution and value-set activation are caller-implemented
  workarounds, not API capabilities, and links to the new bulk guide;
  recommendation paragraph reworded to reflect that bulk is still in
  Preview and that bridging is caller responsibility.
- fabric-hybrid-cicd-guide.md — workflow rename (6 occurrences of the
  old reusable-deploy-supported.yml filename), repo structure tree
  updated with all currently-existing workflows / scripts / data items,
  new note pointing to the bulk path with link to the bulk guide.
- .github/workflows/reusable-deploy-bulk.yml — Known Gaps comment block
  expanded honestly: distinguishes API gaps from caller-bridged gaps,
  notes orphan cleanup is not implemented because the API doesn't
  support delete.
- scripts/deploy_bulk.py — module docstring expanded with the same
  framing (API gaps vs caller bridging) and the Known Gaps list now
  distinguishes 'no full parameter.yml feature coverage' (specific) from
  'no orphan cleanup' (broader).

Verified:
- 173 tests still pass
- Zero stale references to reusable-deploy-supported.yml or the old
  deploy-supported job ID anywhere in the repo
- All cross-links between docs resolve to real anchors