feat(audit): white-box code audit suite (sinks/endpoints/hotspots)

[Dxsk]

Summary

Composable white-box code-audit suite over the engagement code/ zone, run inside Exegol, emitting AI-readable structured artifacts to scans/code/ plus a ranked hotspots report.

• audit-sinks: dangerous functions via semgrep (p/security-audit + p/owasp-top-ten) + ast-grep custom rules + weggli (C/C++).
• audit-endpoints: attack surface via semgrep route rules + xnLinkFinder/grep.
• audit-hotspots (python, stdlib): ranks semgrep + ast-grep + trufflehog findings into hotspots.json/hotspots.md.
• audit-full: orchestrates audit-code → sinks → endpoints → hotspots.
• Install layer adds ast-grep (npm) + weggli (cargo) to load_user_setup; bundled ast-grep/semgrep rules under audit-rules/; deploy/alias/history wiring.
• Design docs: docs/specs/ + docs/plans/.

Test Plan

• make lint clean (audit-hotspots excluded from shellcheck as python).
• make test: 82 bats pass (incl. new tests/audit.bats).
• pytest tests/test_audit_hotspots.py: 5 passed.
• Live container smoke: audit-full on a fixture detects the eval sink (ast-grep) and /admin endpoint (semgrep), correctly ranked in hotspots.md.
• Final code review (no critical/important issues; markdown-escaping + honest-echo fixes applied).