[Ayushxsingh100]

P5b-fix: an unresolved security-group entry must not give PASS (INV-FUNC-001)

An unresolved entry in vpc_security_group_ids (a variable, a concat with a variable, a group of unknown count) could reach row 6 and give PASS when the known groups established the path. Registry §6.3 E3 requires every entry to be resolved and §6.4 row 4 gives UNKNOWN. This PR makes it row 4, on both D and S, and compares the engine with the exact string postgres (E2).

Process (C-28): do not merge until the external review verdict is pasted into this PR. This description contains no verdict.

Changes

• Step 0: the P5b review result recorded in docs/PHASE_GATES.md, as supplied.
• core/verification/reachability.py (6 lines): a side's unresolved entries now reach the row 4 reasons; the engine is compared exactly.
• 21 new tests in tests/unit/test_reachability_unresolved_groups.py, written and shown failing first (12 of 19 failed on the old code).
• Register: C-156 (Proposed) and C-155 item 13.

For the reviewer

• Two P5b tests asserted the superseded result for an unresolved entry of S (PASS, row 6; row 7 with no path). They now assert UNKNOWN, row 4 (C-156 rule 2). This conflicts with "existing suite unchanged"; flagged in the report.
• Open question for the authors: the provider may accept other spellings of the engine name.
• PHASE_GATES.md still has the heading "P5b–P10 — NOT STARTED" below the P5b block (left as instructed).

Evidence

• 3 commits (3cafed1, 8bb5029, f807dee), each run in a clean clone on Python 3.12: OK (skipped=1); tests 3487 → 3508.
• Final tree: dev.py test OK on 3.12 and 3.14 (skipped=2); black, ruff, mypy clean; pytest 3507 passed, 1 skipped.
• Mutation proof: 8 breakages in a scratch copy, all caught.
• NOT RUN: Python 3.13 (not installed); pip-audit (no dependency change).

🤖 Generated with Claude Code