Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)

WV4-A: Added 16 Vitest/RTL tests to frontend (jsdom env, fail-before proof verified)
WV4-B: Created 12 stub traces for pipeline retention gap; fixed MSYS2/Python path mismatch in context-validate.sh; run-casan4-harness-tests.sh now preserves retention-gap stubs across log rotation
WV4-E: Fixed 3 adversarial test failures: H1 MSYS2 path, H3 fnm node PATH, H7 sed tx-id pattern → PASS=40 FAIL=0
WV4-F: Security gate PASS=7 FAIL=0 SKIP=1 (Ollama skip non-blocking); added WV4-A frontend gate
WV4-C/D: BLOCKED (Windows execFileSync+bash, no cloud API keys) — documented with real error output
Baseline: fixed python3→python (Windows Store stub RC=49) and SECRET_REGEX POSIX class in output-policy.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/rollback-manager.sh

@@ -32,7 +32,7 @@ if [[ "$MODE" == "checkpoint" ]]; then
   ABS_TARGET="$(cd "$(dirname "$TARGET")" && pwd)/$(basename "$TARGET")"
   RESTORE_CMD="cp '$BACKUP' '$ABS_TARGET'"
   TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
-  python3 - "$TX_LOG" "$TIMESTAMP" "$TX_ID" "$ABS_TARGET" "$RESTORE_CMD" "$BACKUP" <<'PY'
+  python - "$TX_LOG" "$TIMESTAMP" "$TX_ID" "$ABS_TARGET" "$RESTORE_CMD" "$BACKUP" <<'PY'
 import json, sys
 log, ts, tx, target, cmd, backup = sys.argv[1:]
 rec = {"timestamp": ts, "transaction_id": tx, "action": "checkpoint",
@@ -62,7 +62,7 @@ if [[ "$MODE" == "execute" ]]; then
     echo "ROLLBACK_NOT_FOUND transaction_id=$TX_ID" >&2
     exit 1
   fi
-  COMMAND="$(python3 - "$TX_LOG" "$TX_ID" <<'PY'
+  COMMAND="$(python - "$TX_LOG" "$TX_ID" <<'PY'
 import json, sys
 for line in open(sys.argv[1], encoding="utf-8"):
     rec=json.loads(line)