M6 live verification: re-run all 5 steps + filter infisical banner

Three doc fixes pinned by re-running today's full live-test sweep:

1. Bump status header from 2026-05-06 to "re-run 2026-05-07" with a
   note that all 5 steps still pass against the live AVEVA install.
   The first run of step 1 + step 5 today failed with
   `Error::Status { detail: 5 }` (DCE/RPC fault 0x00000005) traced
   to MX_TEST_DOMAIN being polluted with the infisical CLI's
   "A new release of infisical is available" upgrade banner. The
   banner was being concatenated onto the domain string by
   Setup-LiveProbeEnv.ps1's `2>&1` capture, causing NTLM Type1 to
   send a malformed domain field that NmxSvc rejected.

2. Fix tools/Setup-LiveProbeEnv.ps1 — Get-InfisicalSecret now splits
   captured output on newlines, filters lines matching the
   "^A new release of infisical is available" / "^Please upgrade"
   banner patterns, and returns the last non-empty line (the actual
   secret value from `infisical secrets get --plain`). Robust to
   future banner messages of similar shape.

3. Fix two drifted line citations in docs/M6-live-verification.md:
   `recover_connection_core (session.rs:1428-...)` is now at line
   1374 after F56/F45/F47 edits — strip the line number, keep the
   function name (`Session::recover_connection_core`). Same for
   `Session::unsubscribe (session.rs:2261)`.

4. Add "Workspace gate (no live infra needed)" subsection to the
   "Reproducing locally" recipe so a fresh contributor sees the
   full V1 verification recipe (live + workspace gate) in one place.

All 5 live tests pass post-fix:
  - F36 buffered subscribe (drained 1 raw NMX message; no scan
    activity on TestChangingInt today, matches 5/6 baseline)
  - F45 buffered recovery replay (2 pre + 2 post DataUpdate frames)
  - F47 buffered unsubscribe skip (returned Ok)
  - F40 metrics smoke (4 expected metric names present)
  - F54 OnWriteComplete (status detail 9 = WRITE_COMPLETE_OK)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/Setup-LiveProbeEnv.ps1

@@ -72,8 +72,23 @@ function Get-InfisicalSecret {
         if ($LASTEXITCODE -ne 0 -or -not $value) {
             throw "Get-Secret returned empty for $Env$Path/$Key (exit code $LASTEXITCODE)"
         }
-        # Trim any trailing whitespace from the CLI output
-        return ($value | Out-String).Trim()
+        # The infisical CLI occasionally writes an upgrade-available banner
+        # ("A new release of infisical is available: ...") to stderr; the
+        # `2>&1` redirect above merges it into the value stream. Filter
+        # those banner lines so they don't pollute the returned secret.
+        # Take the last non-empty, non-banner line — the actual secret
+        # value is always the final line of `infisical secrets get --plain`.
+        $clean = ($value | Out-String) -split "(`r`n|`n)" |
+            ForEach-Object { $_.Trim() } |
+            Where-Object {
+                $_ -and
+                ($_ -notmatch '^A new release of infisical is available') -and
+                ($_ -notmatch '^Please upgrade ')
+            }
+        if (-not $clean) {
+            throw "Get-Secret produced no usable line for $Env$Path/$Key after banner filtering"
+        }
+        return ($clean | Select-Object -Last 1)
     } catch {
         throw "Failed to fetch $Env$Path/$Key from Infisical: $_"
     }