[carlospolop]

Summary

Publish the current reviewed CSPM privilege escalation catalog in src/privilege-escalation-paths while retaining the broader research inventory in src/privilege-escalation-paths-research.

The automatic catalog contains 685 active techniques and 3,777 reviewed exclusions. Its active technique IDs and behavior fields match current CSPM main; the seven differences are source revisions that point to the exact documented sections. The APIM SSO anchor matches CSPM PR #331. src/privilege-escalation-paths-cspm-reviewed is retained as an exact review mirror of the canonical automatic catalog.

The research directory preserves all 901 active technique definitions from this PR's original broad catalog, without changing any of those active entries. Its additional paths are not loaded as automatic CSPM findings. This retains research coverage without treating unverified conditions as definite escalation paths.

Validation

• Automatic catalog: 296 YAML files, 685 active techniques, 3,777 exclusions; strict schema and source anchors valid.
• Review mirror: byte-equivalent active entries and the same validation counts.
• Research inventory: 299 YAML files, 901 active techniques, 3,550 exclusions; strict schema and source anchors valid.
• All 901 research active entries match the original PR head. No research technique was removed.
• Validator regression tests: 2 passed. The workflow now validates all three directories, including inline-code source anchors.
• The schema copy and exported JSON Schema match current CSPM main.

Publication dependency

This remains a draft for human review. Earlier submissions #491 and #503 were closed by automated review because this catalog and documentation scope requires a human reviewer. After this Cloud PR is accepted, CSPM must pin the published revision and preserve the outgoing catalog binding and API display history. The older CSPM draft #291 was closed because its source pin and generated artifacts predated current main; its seven source corrections are carried here for a fresh rebind.