feat(code-audit): add README auditor as first code-audit slice

[W00DSRULES]

Introduces a second domain alongside the thesis pipeline: factual-claim audit of technical artefacts against the actual codebase. The README auditor (openworkers audit readme <repo>) is the first slice; PR / compliance / architecture auditors will follow on the same primitives.

The trust gate ("no verdict without evidence") is enforced in providers/code_audit_agents.py::_enforce_trust_gate after the LLM returns, not delegated to prompts. The audited README is excluded from its own evidence pool so fabricated claims cannot self-verify.

New modules:

• core/sources/ — SourceAdapter ABC + LocalRepoAdapter (grep + scope guard)
• core/schemas_audit.py — Pydantic audit models (kept separate from the thesis schemas so the two domains evolve independently)
• core/orchestrator/readme_flow.py — ReadmeAuditOrchestrator
• providers/code_audit_agents.py — planner/checker/critic + trust gate
• prompts/code_audit/*.md — audit templates with explicit JSON schemas
• apps/cli/main.py — audit readme subcommand alongside thesis ...
• tests/code_audit/ + tests/fixtures/sample_repo/ — fixture-driven end-to-end test including an explicit trust-gate-override assertion

Docs:

• AGENTS.md — onboarding for future agents/contributors
• README.md — new "Code audit" section
• ROADMAP.md — new "Code-audit track" section
• CHANGELOG.md — Unreleased entry

Verification: 153/153 tests pass (existing thesis suite + 3 new), mypy strict clean on new modules, ruff clean on new files (2 pre-existing warnings in cmd_corpus/cmd_ingest predate this slice), black formatted.

Summary

Changes

Testing

• pytest tests/ -v passes
• ruff check . passes
• black --check . passes
• mypy core/ providers/ --strict --ignore-missing-imports passes

Checklist

• I have read CONTRIBUTING.md
• Code follows project style (black, ruff, mypy strict for core/providers)
• Tests added or updated for the changes
• Documentation updated if needed