docs(04-review-download-security): create phase 4 plan

5 plans across 5 waves: Wave 0 TDD stubs, utilities + OutputBlock,
ReviewStep implementation, App.tsx wiring, human verify checkpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.planning/ROADMAP.md

@@ -76,7 +76,14 @@ Plans:
   3. The app prominently displays that no data is sent to any server, and wizard state is never written to localStorage or sessionStorage
   4. User can download each artifact individually (rclone.conf, Intune install script, Intune detection script, RMM script) or all together as a ZIP bundle
   5. User can copy any output block to clipboard without downloading
-**Plans**: TBD
+**Plans**: 5 plans
+
+Plans:
+- [ ] 04-01-PLAN.md — Wave 0 TDD stubs: ReviewStep.test.tsx (all requirement stubs RED) + SECU-03 assertion in reducer.test.ts
+- [ ] 04-02-PLAN.md — Utilities and OutputBlock: downloadFile.ts, downloadZip.ts (install jszip), OutputBlock.tsx component
+- [ ] 04-03-PLAN.md — Implement ReviewStep.tsx: live preview, security gate, all downloads and clipboard — all stubs turn GREEN
+- [ ] 04-04-PLAN.md — Wire ReviewStep into App.tsx (step 3) and add 'Review' to StepIndicator STEP_LABELS
+- [ ] 04-05-PLAN.md — Human verification: full 4-step wizard end-to-end, all downloads, ZIP, clipboard, SECU-03 DevTools check
 
 ## Progress
 
@@ -88,4 +95,4 @@ Phases execute in numeric order: 1 → 2 → 3 → 4
 | 1. Foundation | 4/4 | Complete   | 2026-03-26 |
 | 2. Generators | 4/4 | Complete   | 2026-03-26 |
 | 3. Wizard UI | 5/5 | Complete   | 2026-03-27 |
-| 4. Review, Download & Security | 0/? | Not started | - |
+| 4. Review, Download & Security | 0/5 | Not started | - |