fix(bitdefender): fourth-pass - urllib reset safety, Retry-After clamp, sweep/install-links id validation

From a third review pass (converging - all MEDIUM/LOW):
- urllib fallback: a post-send reset (RemoteDisconnected/ConnectionReset, which
  urllib wraps in URLError) was misclassified as always-safe 'connect' and could
  retry a non-idempotent write after a server commit. Now only ConnectionRefused/
  DNS (socket.gaierror) -> 'connect'; everything else -> 'timeout' (write-gated).
- _retry_delay clamps a negative numeric Retry-After to 0 (was -> time.sleep(-1) ValueError).
- cmd_sweep + cmd_install_links now validate --company; cmd_company_create validates
  --parent (finished _require_oid consistency - these mislogged as errorlog noise).
- cmd_push_test parses --extra-json before gating (validate->gate order, matches siblings).
- selftest: +sweep/install-links bad-company assertions. 81/81. Units: clamp + reset classification.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/bitdefender/scripts/gz.py

@@ -284,6 +284,8 @@ def cmd_company_create(client, args):
     extra, rc = _load_json_arg(args.extra_json, "extra-json")
     if rc:
         return rc
+    if args.parent and not _require_oid(args.parent, "parent company"):
+        return 2
     label = {0: "Partner", 1: "Customer"}.get(args.type, str(args.type))
     if not _gated(f"create {label} company '{args.name}'", args.confirm):
         return 3
@@ -337,6 +339,8 @@ def cmd_endpoint(client, args):
 
 
 def cmd_sweep(client, args):
+    if args.company and not _require_oid(args.company, "company"):
+        return 2
     if args.company:
         summaries = client.security_sweep(args.company)
     else:
@@ -535,11 +539,11 @@ def cmd_push_set(client, args):
 
 
 def cmd_push_test(client, args):
-    if not _gated(f"send test push event '{args.event_type}'", args.confirm):
-        return 3
     extra, rc = _load_json_arg(args.extra_json, "extra-json")
     if rc:
         return rc
+    if not _gated(f"send test push event '{args.event_type}'", args.confirm):
+        return 3
     result = client.send_test_push_event(args.event_type, extra=extra or None)
     _emit({"testEvent": args.event_type, "result": result}, args.json, _print_kv)
     return 0
@@ -702,8 +706,11 @@ def cmd_create_package(client, args):
 
 
 def cmd_install_links(client, args):
+    if args.company and not _require_oid(args.company, "company"):
+        return 2
     _emit(client.get_installation_links(args.package, args.company),
           args.json, _print_kv)
+    return 0
 
 
 def cmd_scan(client, args):