Release 3.0.2 patch: correct unsupported Kerberos fallback and documentation

[netanelcyber]

The existing release branch still attempts to obtain a KRBTGT key from LDAP unicodePwd, which AD never returns in a search. This patch removes that unsupported path: failed/refused collection retains success=False, no key and no generated ticket. The legacy SPN formatter is documented as account/SPN metadata. WinRM report tests now read the UTF-8 artifacts explicitly, fixing Windows locale-dependent decoding failures.

Carries the approved core and documentation corrections from #95 onto the current 3.0.2 release tree, preserving its WinRM profile and existing APIs. Replaces unsupported escalation/CVE claims with evidence limits and remediation, documents all eight profiles through python -m adpentest --diagnostic-tools all, and corrects the package documentation URL.

Publication uses the existing PyPI secret through the standard build workflow. Only a push to the exact release/pypi-3.0.2 branch adds an automatic upload trigger, guarded by version consistency, compilation, the regression suite and strict Twine checks. The preparation branch does not publish. Release/manual publication events remain supported.

Validation:

• 518 tests and 264 subtests passed; 3 dependency/platform skips on Linux.
• Package/tests compilation, wheel/sdist builds and strict Twine validation passed.
• All wheel source bytes, version, runtime dependencies, WinRM module and HTML template verified.
• Installed-wheel diagnostics (all eight profiles), WinRM and legacy dry-runs passed; SQLite persistence verified.
• Remote tree verified against the tested local files; only 13 intended files changed.
• Windows/Linux GitHub CI passed for d3720b78ca757a5746d5aac5c7aa159da3aad28b.
• PyPI 3.0.2 published successfully through GitHub Actions from the same tested commit on release/pypi-3.0.2.
• Downloaded both published distributions, verified their PyPI SHA-256 digests, and checked that packaged source, the Windows report tests and regression tests match the tested Git tree. Release-branch Windows/Linux CI also passed.

No live AD/KDC authentication was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T16:52:39.691198Z	d3720b7	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.