fix: broken Microsoft Learn data classification link in security-planning skill reference #2758

Component

Skills

Bug Description

.github/skills/project-planning/security-planning/references/data-classification.md cites a Microsoft Learn page that returns 404, which fails npm run lint:md-links and therefore the npm run validate:local aggregate.

Line 92:

* Microsoft data classification categories (Customer Data, EUII, EUPI, OII): <https://learn.microsoft.com/compliance/assurance/assurance-data-classification>

The 404 is genuine, not a transient network failure. The sibling Purview link on line 91 resolves normally:

This is not a simple URL swap

The nearest successor is https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-classification-and-labels — same path family, returns 200, titled "Data classification & sensitivity label taxonomy - Microsoft Service Assurance".

However, reading the rendered page shows it contains "Customer Data" only. It does not mention EUII, EUPI, or OII. A Learn-wide search for those terms returned no page documenting them as a taxonomy; results were that same page plus unrelated Q&A threads and Purview/Databricks/Well-Architected content.

The current citation claims four categories and the best available replacement supports one, so repointing the URL alone would leave the line overclaiming its source.

Expected Behavior

Every link in the skill reference resolves, npm run lint:md-links passes, and the cited source actually supports the categories named alongside it.

Steps to Reproduce

1. Run npm run lint:md-links (or npm run validate:local).
2. Observe the failure reported for .github/skills/project-planning/security-planning/references/data-classification.md.
3. In logs/mlc-full-run.txt:

? https://learn.microsoft.com/compliance/assurance/assurance-data-classification  Status: 404
WARNING: ERROR [.github\skills\project-planning\security-planning\references\data-classification.md] Broken link:
https://learn.microsoft.com/compliance/assurance/assurance-data-classification (Status: 404)

Additional Context

Three possible resolutions, requiring an editorial decision about the skill's content:

1. Repoint and narrow. Use assurance-data-classification-and-labels and reword the description to what that page actually covers (Customer Data plus the sensitivity-label taxonomy), dropping the EUII/EUPI/OII claim.
2. Find a different source that still defines EUII/EUPI/OII — likely Service Trust Portal or a Microsoft privacy/data-protection doc rather than Learn.
3. Remove the line if those categories are not load-bearing for the skill.

Option 1 is the safest default if the EUII/EUPI/OII terminology is not relied on elsewhere in the skill; option 2 preserves the original intent if it is.

Discovered incidentally while running validate:local for the #2724 branch. Unrelated to that change — #2724 modifies no markdown.

SECURITY.md also intermittently reports a broken link on https://aka.ms/security.md/msrc/bounty (Status: 0), but that varies between runs and looks like a transient timeout rather than a real breakage. Not included here.