Fix two Validate execution phase bugs and two false documentation claims

[seebi]

Fixes the four findings a max effort code review raised against the branch merged as #2, each verified against a live deployment rather than argued from reading.

Two bugs in the Validate execution phase action

• result = None crashed the action with AttributeError: 'NoneType' object has no attribute 'schema'. The action tested if "result" in scope, but assigning None is legitimate - execute() is annotated Entities | None, and the documentation calls it the way to hand nothing to the next task. Omitting the assignment printed No result provided.; assigning None crashed.
• data accumulated across clicks. The action re-ran the initialization code for test_inputs but passed the constructor's self.data, so with init data['count'] = 0 and execution data['count'] += 1, three clicks gave 1, 2, 3 instead of 1 every time.

Both now have regression tests. Stashing the source fix makes both fail, restoring it makes both pass. Neither needs a deployment, so neither carries needs_cmem.

Two false claims

• The dependency caveat said a failed installation lets execution continue and fail later at the import. It does not: the deployment answers 400, cmem-client raises RepositoryModificationError, and the run stops before the execution code. Confirmed by installing this-package-definitely-does-not-exist-zzz999 against a real deployment. The caveat now says a misspelled dependency fails the workflow run rather than the import, and that the Install missing dependencies action reports the error instead of its per package output.
• The README quick start called task clean check plugin:install, which stopped existing when the template update added flatten: true to that include. Verified: task --dry clean check plugin:install exits 200, task --dry clean check install exits 0.

Breaking change, accepted rather than fixed

setup_cmempy_user_access also set OAUTH_GRANT_TYPE and OAUTH_ACCESS_TOKEN in the environment of the whole process, which task code calling cmem.cmempy.* could rely on without setting up access itself. Removing it dropped that side effect, so such code now has to authenticate on its own. No code change here - the changelog records it as breaking, and the documented way is get_client(context).

Verification

task check is green: 14 tests, 100% coverage, ruff, mypy, deptry and trivy clean. The reworded caveat was read back through discover_plugins() as a user sees it, not only in the source.

Not in this PR

Ten further findings from the same review remain open, the two most notable being that install failures are discarded end to end (a package which installs but fails to register reports clean success with no log line) and that cmem-client's PythonPackage is its one extra="forbid" model, so any new field in the DataIntegration response would crash every package touching code path at once.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q2PdymJgUZnA8KZKMEiUvm

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
init.py	0	0	100%
package_management.py	19	0	100%
test_transform_operator.py	17	0	100%
workflow_task.py	109	0	100%
TOTAL	145	0	100%

Tests	Skipped	Failures	Errors	Time
14	0 💤	0 ❌	0 🔥	35.780 ⏱