feat(bitdefender): doc-verify assignPolicy/push + add full-API build-out tracker

- assign_policy: add inheritFromAbove option; mark VERIFIED via official docs
  (policyId/targetIds/forcePolicyInheritance/inheritFromAbove; not applied to
  ENFORCED-policy targets).
- setPushEventSettings: documented serviceType (splunk/cef/jsonRPC), TLS 1.2+
  receiver requirement, subscribeToEventTypes event-flag map; webhook receiver
  pattern noted.
- api-reference.md: cite GravityZone Support Center as authoritative source.
- add references/BUILDOUT.md — master checklist to implement every API method
  module-by-module; seeded with current done/todo/dead state.
- memory: reference_gravityzone_support (+ index).

selftest 42/42.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/bitdefender/references/api-reference.md

@@ -1,5 +1,10 @@
 # Bitdefender GravityZone Cloud Public API Reference
 
+> **Authoritative product + API docs:** GravityZone Support Center —
+> https://www.bitdefender.com/business/support/en/77211-79436-welcome-to-gravityzone.html
+> (everything about the product and the Public API). Use it to confirm any
+> UNVERIFIED method/param below before relying on it.
+
 Verified spec for the methods used by this skill. Sourced from Bitdefender's
 archived Public API documentation. Methods are flagged **VERIFIED** (signature
 confirmed and exposed in the CLI) or **UNVERIFIED** (signature not confirmed —
@@ -110,7 +115,7 @@ In `getNetworkInventoryItems` results, `type == 1` denotes a company node.
 |---|---|---|---|
 | `getPoliciesList` | `page?, perPage?` | VERIFIED | List policies (id, name). |
 | `getPolicyDetails` | `policyId` | VERIFIED | **Full** granular config (not shallow). |
-| `assignPolicy` (`/network`) | `policyId, targetIds[], forcePolicyInheritance?` | VERIFIED LIVE (param shape) | Assign existing policy to endpoints/groups. Param shape confirmed via validation probe 2026-06-21. CLI `assign-policy`, gated. STATE-CHANGING. |
+| `assignPolicy` (`/network`) | `policyId, targetIds[], forcePolicyInheritance?, inheritFromAbove?` | VERIFIED (official docs + probe) | Assign existing policy to endpoints/containers. NOT applied to targets with an ENFORCED policy. CLI `assign-policy`, gated. STATE-CHANGING. Docs: 77212-924802-assignpolicy.html |
 
 ## reports (`/reports`) — VERIFIED LIVE
 
@@ -139,7 +144,12 @@ In `getNetworkInventoryItems` results, `type == 1` denotes a company node.
 |---|---|---|---|
 | `getPushEventSettings` | `{}` | VERIFIED LIVE | Current settings. CLI `push-settings`. |
 | `getPushEventStats` | `{}` | VERIFIED LIVE | Delivery stats. CLI `push-stats`. |
-| `setPushEventSettings` | `status (req), serviceType, serviceSettings{url,requireValidSslCertificate,authorization}, subscribeToEventTypes?` | `status` VERIFIED (probe); nested shape UNVERIFIED | Configure the service. CLI `push-set`, gated. STATE-CHANGING. Needs a receiver URL.
+| `setPushEventSettings` | `status (req), serviceType, serviceSettings{url,requireValidSslCertificate,authorization}, subscribeToEventTypes{<event flags>}` | VERIFIED (official docs + probe) | Configure the service. `serviceType` ∈ `splunk`/`cef`/`jsonRPC`. Receiver MUST support TLS 1.2+. `subscribeToEventTypes` is a map of event flags (av, fw, aph, registration, task-status, modules, network-sandboxing, antiexploit, dp, uc, …) set true to subscribe. Returns bool. CLI `push-set`, gated. STATE-CHANGING. Needs a receiver URL. Docs: 77209-135319-setpusheventsettings.html
+
+> Receiver pattern for the webhook (Phase-2): stand up an HTTPS endpoint (TLS
+> 1.2+, valid cert) that accepts GravityZone's event POSTs — a coord-API route
+> or an RMM ingest route — then `push-set --status 1 --url <that-endpoint>
+> --confirm`. `serviceType jsonRPC` posts JSON-RPC event batches.
 
 ## quarantine (`/quarantine`)