Document current Semaphore defects

[dantro86]

Summary

• consolidate nine reproducible Semaphore defects into one prioritized register
• provide descriptions, impact, reproduction steps, expected and actual results
• link each entry to its detailed technical evidence and automated reproducer
• distinguish confirmed defects from a product-contract candidate, a historical upgrade issue and a security-hardening gap
• revalidate the core, persistent-runner, scheduler and dynamic-runner findings against stable v2.19.12
• record which fixes exist only on develop and what must be rerun on the next stable release

Current status

• BUG-001, BUG-002, BUG-004, BUG-005, BUG-007 and BUG-009 are confirmed by Linux CI on v2.19.12
• BUG-003 (run_at and cron) and BUG-006 are reconfirmed locally on v2.19.12
• BUG-004, BUG-008 and BUG-009 have fixes on develop, but remain open for stable v2.19.12
• BUG-005 remains a defect candidate until the product team confirms the unavailable-runner queue contract

Validation

• local Gradle qualityGate: passed
• v2.19.12 configuration matrix: all 11 profiles passed and preserved the expected-defect evidence
• scheduler reproducer: both active one-shot and cron scenarios reached task-creation timeout on v2.19.12
• dynamic one-off runner reproducer: task and finish webhook completed, but runner_exited did not appear on v2.19.12
• affected product paths compared with stable v2.19.12 and current develop (e5ad68da)

PR dependency

This documentation PR is based on #7 because that PR isolates the strict BUG-009 reproducer from the
green stable gate. Running this branch directly on the previous main reproduces BUG-009 in
ShellOutputTest, which is product evidence rather than a documentation regression.

Screenshots are intentionally omitted because these findings concern API, scheduler, task-output and
runner lifecycle behaviour. Sanitized API responses, process state, CI artifacts and server logs are
the relevant evidence.