verify(P4): migrate-ssm-except-narrowing — 4-layer verify PASS + ship

VERIFY: structural — narrowed excepts; behavioral — 48 tests + CI PASS; security — non-ParameterNotFound errors surface; quality — 2 new + 2 updated tests.

---ci---
project: acdl
phase: 4
milestone: v1.16
status: complete
phase_role: execution
requirements:
  covered: [REQ-168]
  partial: []
---/ci---

tests/test_output_publisher.py

@@ -134,7 +134,11 @@ class TestPublishToSsm:
             def flaky_put(**kwargs):
                 call_count["n"] += 1
                 if "bad" in kwargs["Name"]:
-                    raise Exception("simulated failure")
+                    from botocore.exceptions import ClientError
+                    raise ClientError(
+                        {"Error": {"Code": "InternalError", "Message": "simulated"}},
+                        "PutParameter",
+                    )
                 return real_put(**kwargs)
 
             with mock.patch("core.output_publisher._ssm_client", return_value=ssm):
@@ -272,10 +276,11 @@ class TestPostGithubComment:
         assert "/issues/5/comments" in captured["url"]
 
     def test_returns_false_on_exception(self, monkeypatch):
+        import urllib.error
         monkeypatch.setenv("GITHUB_TOKEN", "tok")
         monkeypatch.setenv("GITHUB_REPOSITORY", "acdl/acdl")
         monkeypatch.setenv("GITHUB_REF", "refs/pull/1/merge")
-        with mock.patch("urllib.request.urlopen", side_effect=Exception("boom")):
+        with mock.patch("urllib.request.urlopen", side_effect=urllib.error.URLError("boom")):
             assert post_github_comment("body") is False
 
     def test_uses_gh_token_fallback(self, monkeypatch):