feat(bitdefender): doc-verify assignPolicy/push + add full-API build-out tracker

- assign_policy: add inheritFromAbove option; mark VERIFIED via official docs
  (policyId/targetIds/forcePolicyInheritance/inheritFromAbove; not applied to
  ENFORCED-policy targets).
- setPushEventSettings: documented serviceType (splunk/cef/jsonRPC), TLS 1.2+
  receiver requirement, subscribeToEventTypes event-flag map; webhook receiver
  pattern noted.
- api-reference.md: cite GravityZone Support Center as authoritative source.
- add references/BUILDOUT.md — master checklist to implement every API method
  module-by-module; seeded with current done/todo/dead state.
- memory: reference_gravityzone_support (+ index).

selftest 42/42.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/memory/reference_gravityzone_support.md

@@ -0,0 +1,16 @@
+---
+name: reference_gravityzone_support
+description: Authoritative GravityZone product + Public API documentation (Bitdefender Support Center)
+metadata:
+  type: reference
+---
+
+GravityZone Support Center — authoritative docs for the Bitdefender product and
+its Public JSON-RPC API (methods, params, modules):
+https://www.bitdefender.com/business/support/en/77211-79436-welcome-to-gravityzone.html
+
+Use it to confirm UNVERIFIED methods/param shapes before relying on them in the
+`bitdefender` skill — e.g. `push.setPushEventSettings` nested shape,
+`network.assignPolicy` options, report/account write methods, and the correct
+`maintenancewindows`/`integrations` method names. The skill's own verified-vs-
+unverified spec lives in `.claude/skills/bitdefender/references/api-reference.md`.