Address second round of Jesper Schulz-Wedde's review on PR #157

- log-writes-must-survive-rollback.good.al: fixed invalid trigger
  OnRun(var Rec: ...) declaration; Rec is implicit when TableNo is set.
- exposed-objects-must-be-in-a-permission-set.md: distinguished the three
  exposure mechanisms (page/query web service or API, codeunit published
  as a web service, [ServiceEnabled] bound action on a page) and their
  actual permission targets (page/query "..." = X vs codeunit "..." = X).
- code-must-not-change-workdate.md: scoped from an absolute "never" to
  "not as a side effect of unrelated logic" - verified real WorkDate(x)
  setter usage in BCApps demo-data generators and test codeunits.
- bcpt-scenarios-must-be-app-specific.md: SingleInstance and
  StartScenario/EndScenario reframed as context-dependent patterns, not
  mandatory requirements - BCPT Create Customer uses neither.
- test-feature-scenario-tags.good.al/.bad.al: replaced the invented
  LibrarySales.CreateCustomerWithPrice/"Item Price Mgt." calls with a real,
  verified price-list-line test using Library - Sales/Library - Inventory/
  Library - Price Calculation.
- page-design-must-match-bc-page-type-conventions.md: scoped the missing
  UsageCategory anti-pattern to pages intended as searchable entry points.
- defensive-vs-offensive-code-must-match-blast-radius.md/.good.al/.bad.al:
  replaced the VAT registration number "low blast radius" example with a
  genuinely cosmetic field (customer home page URL).
- source-organized-by-feature-not-object-type.md: anti-pattern reframed as
  inconsistency with a repo's own convention, not the object-type scheme
  itself.
- pictures-must-use-media-not-blob.md: removed leftover "image variants"
  wording contradicting the already-corrected MediaSet description.

Proactively fixed while sweeping all fixtures for invented APIs:
- given-blocks-must-cover-full-precondition-chain.bad.al: PostSalesOrder
  called with wrong arity and referenced an undeclared variable.
- ui-test-codeunit-naming.good.al/.bad.al: replaced the same fake
  "Item Price Mgt."/TestPage "Item Price" with real Library - Sales calls
  and the real Customer Card TestPage.

Worklist completeness: added review-skill cues for the 12 of 18 new rules
that had none (al-appsource-review.md, al-data-modeling-review.md,
al-error-handling-review.md, al-security-review.md, al-style-review.md x3,
al-testing-review.md x2, al-ui-review.md, al-upgrade-review.md,
al-web-services-review.md), and fixed test-feature-scenario-tags' cue,
which only matched the compliant (tagged) shape instead of the anti-pattern
(untagged/generic-named test).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

microsoft/knowledge/error-handling/defensive-vs-offensive-code-must-match-blast-radius.bad.al

@@ -1,6 +1,6 @@
 // Both fields guarded the same way, out of habit rather than analysis.
-if SalesHeader.Get(SalesHeader."Document Type"::Order, DocumentNo) then
-    VATRegNo := SalesHeader."VAT Registration No.";  // low blast radius - fine
+if Customer.Get(SalesHeader."Sell-to Customer No.") then
+    CustomerHomePage := Customer."Home Page";  // low blast radius - fine
 
 // but the same pattern, unexamined, was also applied here:
 if SalesHeader.Get(SalesHeader."Document Type"::Order, DocumentNo) then

microsoft/knowledge/error-handling/defensive-vs-offensive-code-must-match-blast-radius.good.al

@@ -1,8 +1,8 @@
 // Low blast radius: guard, with an explicit chosen fallback.
-if SalesHeader.Get(SalesHeader."Document Type"::Order, DocumentNo) then
-    VATRegNo := SalesHeader."VAT Registration No.";
+if Customer.Get(SalesHeader."Sell-to Customer No.") then
+    CustomerHomePage := Customer."Home Page";
 // Blank is an acceptable, deliberately-considered default here - the field
-// is informational and a reviewer sees it before the document ships.
+// is purely a display convenience and a reviewer sees it before the document ships.
 
 // High blast radius: let it fail loud, because this feeds posted VAT.
 SalesHeader.Get(SalesHeader."Document Type"::Order, DocumentNo);

microsoft/knowledge/error-handling/defensive-vs-offensive-code-must-match-blast-radius.md

@@ -21,6 +21,6 @@ See sample: `defensive-vs-offensive-code-must-match-blast-radius.good.al`.
 
 ## Anti Pattern
 
-Guarding two fields the same way purely out of habit, without analyzing what each one feeds. A low-blast-radius field, such as a VAT registration number shown only on a printed document, and a high-blast-radius field, such as the VAT posting group that determines VAT actually applied to a posted transaction, are both wrapped in the same `if Header.Get(...) then ... else` pattern with a blank/zero fallback — leaving the posting-critical field free to post with a silently wrong value.
+Guarding two fields the same way purely out of habit, without analyzing what each one feeds. A low-blast-radius field, such as a customer's home page URL shown only for convenience on a printed document, and a high-blast-radius field, such as the VAT posting group that determines VAT actually applied to a posted transaction, are both wrapped in the same `if Header.Get(...) then ... else` pattern with a blank/zero fallback — leaving the posting-critical field free to post with a silently wrong value. A VAT registration number is not a safe stand-in for the low-risk side of this example: it is legally relevant, often validated, and can feed external VAT services or mandated document output, so it belongs on the offensive/fail-fast side alongside the posting group, not next to it as the "safe" contrast.
 
 See sample: `defensive-vs-offensive-code-must-match-blast-radius.bad.al`.

microsoft/knowledge/error-handling/log-writes-must-survive-rollback.good.al

@@ -15,7 +15,7 @@ codeunit 50100 "Sample Error Log Writer"
     // session — there is no shared memory with the caller's instance.
     TableNo = "Sample Error Log Buffer";
 
-    trigger OnRun(var Rec: Record "Sample Error Log Buffer")
+    trigger OnRun()
     var
         ErrorLogEntry: Record "Sample Error Log";
     begin