workflow: Add optional context audit

[davidabram]

Summary

Add sce-audit as a phase-free optional workflow that audits the complete current-state context/ surface against implementation truth and repairs only proven drift.

The audit compares context to implementation and implementation to context, classifies findings as verified, drifted, missing, orphaned, or unverifiable, preserves unverifiable claims, and verifies the resulting context before reporting clean, repaired, or blocked.

Safety boundary

• Never uses context/decisions/, context/plans/, context/handovers/, or context/tmp/ as current-state authority.
• Never creates, edits, moves, renames, or deletes files in those protected trees.
• Never invokes sce-decision or creates an ADR.
• Never modifies application code, tests, configuration, plan state, hooks, or Git state.
• Treats dirty current-state context files as read-only.

Integration

• Registers audit with optional = true in the typed workflow catalog.
• Reuses the existing catalog-derived optional-workflow manifest, config schema, setup filtering, doctor expectations, target routing, OpenCode permissions, and Codex metadata.
• Generates equivalent two-document packages for OpenCode, Claude, Pi, and Codex; Codex additionally receives agents/openai.yaml.

Workflow evidence

Plan: context/plans/sce-audit-workflow.md

• T01: modeled and context-synchronized.
• T02: renderer/optional-workflow integration is under validation; current-state count and inventory context will be synchronized after the generation contract is green.

Validation

• nix run .#pkl-check-generated
• nix flake check