[dd-Splunk]

Summary

• Add near-miss routing evals: upgrade-safety advice (negative), Splunk Operator for Kubernetes (negative), compose help with no Splunkbase app (negative), version pick for a target Splunk (positive), name-only compose request (positive).
• Add canary_image_version, a behavior eval on app 7931 that checks the Splunk version is taken from an image tag and compatibility comes from script output, not memory.
• Fix a literal \n in the outdated_report_not_advice grading instructions.
• Evals only: no skill or script change, so no version bump or release. Total is now 20 evals.

Test plan

• Unit tests pass (149, 8 live skipped) and ruff clean
• The 5 new routing prompts and the canary behavior eval were run through subagents and matched their expected outcome
• CI green

🤖 Generated with Claude Code