docs: record Phase C cutover; close $IsWindows shim bug (Phase C9)

- CLAUDE.md: Linux host no longer runs pwsh; PS 5.1 constraints scoped to
  Windows guests + Windows runner.
- RUNBOOK: add "Phase C — Python equivalents" table; §6-§13 benchmark records
  kept as historical provenance.
- TODO §3.7: close $IsWindows shim bug (resolved-by-replacement — bench run
  bypasses the shim).
- plans: mark C1-C8 done + docs C9; flag operational cutover/uninstall pending.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/RUNBOOK.md

@@ -738,8 +738,28 @@ running §11–§13; required for any Windows-host orchestration:
    `Invoke-CIJob.ps1` interactively. The shim's auto-detect branch dereferences
    `$IsWindows`, which is undefined under Windows PowerShell 5.1 + `StrictMode`
    and throws `VariableIsUndefined`; setting `CI_VENV_PYTHON` skips that branch.
-   Production sets it via the runner (`CI_PYTHON_LAUNCHER`). A code fix to guard
-   the `$IsWindows` reference is tracked in `TODO.md`.
+   Production sets it via the runner (`CI_PYTHON_LAUNCHER`). *Note (Phase C): on
+   the Linux host this is moot — burn-in now runs via `bench run` (below), which
+   never touches the shim.*
+
+### Phase C — Python equivalents (run these on the Linux host; no `pwsh`)
+
+The manual `.ps1` procedures above are superseded by native CLI commands. Invoke
+as the service user (`sudo -u ci-runner /opt/ci/venv/bin/python -m ci_orchestrator ...`):
+
+| Old PowerShell (Linux host)                         | Python command                                   |
+| --------------------------------------------------- | ------------------------------------------------ |
+| `Test-CapacityBurnIn.ps1 -Parallelism 4 -Rounds 10` | `bench run --concurrency 4 --rounds 10 --guest-os linux` |
+| `Measure-CIBenchmark.ps1 -Iterations N`             | `bench measure --iterations N --guest-os linux`  |
+| `Test-Smoke.ps1 -GuestOS Linux`                     | `smoke run --guest-os linux`                     |
+| `Validate-HostState.ps1` (host checks)              | `validate host`                                  |
+| `Test-CIGuestWinRM.ps1` (transport diag)            | `validate guest --host <IP> [--winrm\|--ssh]`    |
+| `Set-CIGuestCredential.ps1`                          | `creds set --target BuildVMGuest --user <u> --password-stdin` |
+
+`bench run` writes a JSON report to `CI_ARTIFACTS/bench/`; `bench measure` appends
+to `benchmark.jsonl` (same fields as before, so the §6–§13 trend lines stay
+comparable). The benchmark records in §6–§13 above are kept as historical
+provenance — they were captured with the `.ps1` tools before the cutover.
 
 ---