test(m3): PHP transfer not established; the taint batch cannot answer PMPro

All three PMPro comparisons exhausted a 3000-second deadline with a 1200-second
query ceiling and produced no artifact, so there is no target evidence at all. The
engine reports `cpg batch taint failed` twice per case on the 1,274-file tree:
first an exception whose trace runs through ujson array transformation, then a
timeout on the retry.

Budgets tried: 900 s, 1200 s and 3000 s deadlines against 300 s and 1200 s query
ceilings. The pins, source receipts and declared target are all correct, so the
question was asked properly and the engine could not answer it. This is a runtime
blocker on a large repository, not evidence about whether the design transfers to
PHP.

Two harness defects were found on the way, and both had made an earlier run look
like a transfer failure rather than an instrument problem. The manifest labels a
case by what it is, vulnerable or fixed or benign, while the id says what the
comparison does, introduce or repair or benign; filtering on one while keying
expectations by the other ran a single case and reported an all-false verdict. And
the per-query ceiling is taken as the minimum with the remaining transaction time,
so raising only the deadline could never have helped, and twice did not.

M3 is not met. Its exit asks for Node, PHP and Python together: Python is
established, Node was established in M1b, PHP is blocked.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.kiro/specs/pre-push-safety-net/release-milestones.md

@@ -136,7 +136,21 @@ Requirements: 4.1–4.4, 6.2–6.5, 7.3.
 
 ## M3 — The shared design transfers across languages
 
-Status: **PENDING M2**.
+Status: **PARTIAL, 2026-09-17. Not met.** Python is established and PHP is blocked by runtime.
+
+Python: all three declared VAmPI targets detected at their declared lines with their questions
+answered, 35 of 35 questions complete on every case, nothing reported new on identical revisions,
+zero admitted defects. That includes the SQL injection this spec names as previously unresolved,
+and both broken-object-level-authorization targets, which is the first time access control has
+answered on Python at all.
+
+PHP: not established. All three PMPro comparisons exhausted a 3000-second deadline with a
+1200-second query ceiling and produced no artifact, so there is no target evidence. The taint
+batch fails on the 1,274-file tree, first with an engine exception and then by timeout. The pins,
+receipts and declared target are correct, so this is a runtime blocker on a large repository
+rather than evidence about whether the design transfers.
+
+The exit asks for Node, PHP and Python together. Two of three are in hand.
 
 - Repeat the useful vulnerable/fixed comparisons with PMPro/PHP and VAmPI/Python,
   including the previously unresolved VAmPI SQLI query/path evidence. Preserve explicit