feat(bitdefender): doc-verify assignPolicy/push + add full-API build-out tracker

- assign_policy: add inheritFromAbove option; mark VERIFIED via official docs
  (policyId/targetIds/forcePolicyInheritance/inheritFromAbove; not applied to
  ENFORCED-policy targets).
- setPushEventSettings: documented serviceType (splunk/cef/jsonRPC), TLS 1.2+
  receiver requirement, subscribeToEventTypes event-flag map; webhook receiver
  pattern noted.
- api-reference.md: cite GravityZone Support Center as authoritative source.
- add references/BUILDOUT.md — master checklist to implement every API method
  module-by-module; seeded with current done/todo/dead state.
- memory: reference_gravityzone_support (+ index).

selftest 42/42.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/bitdefender/scripts/gz.py

@@ -276,7 +276,9 @@ def cmd_assign_policy(client, args):
     if not _gated(desc, args.confirm):
         return 3
     result = client.assign_policy(
-        args.policy, args.targets, force_inheritance=args.force_inheritance
+        args.policy, args.targets,
+        force_inheritance=args.force_inheritance,
+        inherit_from_above=args.inherit_from_above,
     )
     _emit({"assignedPolicy": args.policy, "targets": args.targets,
            "result": result}, args.json, _print_kv)
@@ -668,6 +670,8 @@ def build_parser() -> argparse.ArgumentParser:
                     help="One or more endpoint/group ids.")
     sp.add_argument("--force-inheritance", action="store_true",
                     help="Force policy inheritance to sub-items.")
+    sp.add_argument("--inherit-from-above", action="store_true",
+                    help="Inherit the policy from the parent group.")
     sp.add_argument("--confirm", action="store_true")
 
     sp = sub.add_parser("push-set",

.claude/skills/bitdefender/scripts/gz_client.py

@@ -633,17 +633,22 @@ class GravityZoneClient:
         policy_id: str,
         target_ids: list[str],
         force_inheritance: bool = False,
+        inherit_from_above: bool = False,
     ) -> Any:
         """Assign an existing policy to endpoints/groups (network.assignPolicy).
 
-        Param shape VERIFIED LIVE via validation probe (2026-06-21): requires
-        `policyId` and `targetIds` (a list of endpoint/group ids).
-        `forcePolicyInheritance` is optional. STATE-CHANGING — gate at the call
-        site behind --confirm.
+        Param shape VERIFIED against the official docs + live validation probe
+        (2026-06-21): `policyId` and `targetIds` (endpoint/container ids) are
+        required; `forcePolicyInheritance` and `inheritFromAbove` are optional
+        bools. NOTE: the policy is NOT applied to targets that already carry an
+        ENFORCED policy. STATE-CHANGING — gate at the call site behind --confirm.
+        Docs: bitdefender.com/business/support/en/77212-924802-assignpolicy.html
         """
         params: dict = {"policyId": policy_id, "targetIds": target_ids}
         if force_inheritance:
             params["forcePolicyInheritance"] = True
+        if inherit_from_above:
+            params["inheritFromAbove"] = True
         return self._jsonrpc_request("network", "assignPolicy", params)
 
     def list_scan_tasks(