docs(code-review): record SMS-feature review findings + reconcile NotificationService doc

Per-module code review of the SMS notifications feature (reviewed at d6ead8ae) following
code-reviews/REVIEW-PROCESS.md. 19 findings across 7 modules — 1 High, 5 Medium, 13 Low:

- ManagementService-024 (High): provider-config updates Admin-gated to match the UI.
- ConfigurationDatabase-025, CentralUI-034/035, ManagementService-025 (Medium): migration
  data-safety guard, type-aware recipient badge, FromNumber-optional (Messaging-Service-only),
  empty-token-clear guard.
- Remaining Low: secret-encryption + diff + dispatch + factory + contract tests, truncation,
  ctor guard, reserved retry-field docs.
- Won't Fix: Transport-015/016 (shared repo-wide import patterns, not SMS-specific),
  Commons-026 (breaking ergonomics-only change). Deferred: ConfigurationDatabase-027 (live-SQL
  migration test).

All findings closed (0 pending). README.md regenerated; Component-NotificationService.md
updated for the FromNumber-optional + reserved-retry-fields outcomes.

code-reviews/CLI/findings.md

@@ -5,9 +5,9 @@
 | Module | `src/ZB.MOM.WW.ScadaBridge.CLI` |
 | Design doc | `docs/requirements/Component-CLI.md` |
 | Status | Reviewed |
-| Last reviewed | 2026-05-28 |
+| Last reviewed | 2026-06-19 |
 | Reviewer | claude-agent |
-| Commit reviewed | `1eb6e97` |
+| Commit reviewed | `d6ead8ae` |
 | Open findings | 1 |
 
 ## Summary
@@ -1082,3 +1082,36 @@ authoritative source.
 **Resolution**
 
 _Unresolved._
+
+#### Re-review 2026-06-19 (commit `d6ead8ae`) — SMS notifications feature
+
+Per-module review of the CLI SMS surface: `--type email|sms` / `--phones` on `notification list`,
+the `notification sms list|update` subcommands, and `bundle export --sms-configs`. Channel-aware
+validation and the AuthToken-never-printed projection are correct and tested. One Low test-coverage
+finding; Resolved.
+
+### CLI-024 — No contract test pinning `notification sms update` required fields
+
+| | |
+|--|--|
+| Severity | Low |
+| Category | Testing coverage |
+| Status | Resolved |
+| Location | `tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/UpdateCommandContractTests.cs` |
+
+**Description**
+
+`UpdateCommandContractTests` pins the `Required`/optional contract for every other update command's
+core flags, but had no entry for `notification sms update` — a future regression making `--id` or
+`--account-sid` optional (silently sending null) would go uncaught.
+
+**Recommendation**
+
+Add a contract test asserting the required/optional flags for `notification sms update`.
+
+**Resolution**
+
+Resolved 2026-06-19 (commit `a9393c89`): added `SmsUpdate_CoreFieldsRequired`. (Updated in commit
+`33e1802e` when `--from-number` became conditionally validated rather than `Required` — see
+CentralUI-035 — so the test now pins `--id`/`--account-sid` Required and `--from-number`/`--auth-token`
+optional, with the either-or validation covered in `NotificationSmsCommandTests`.)