codebase-issue-auditorlisted

# Codebase Issue Auditor Audit broadly, promote strictly, and publish only with explicit approval. Default to every audit category and severity `medium+`; honor explicit time boxes and exclusions as reported limitations. ## Workflow 1. **Frame from evidence** - Inspect the target repository before asking questions. Read repository guidance, manifests, lockfiles, CI/test configuration, deployment surfaces, issue conventions, `git status`, and the audited commit. - Resolve repository facts locally. Ask only when an undiscoverable product decision would materially change scope, priority, or publication. - Read [references/audit-protocol.md](references/audit-protocol.md) and create a versioned audit bundle following [references/audit-bundle.md](references/audit-bundle.md). Keep working artifacts outside tracked source unless the user requests a saved report. - Complete this phase only when the bundle records the target and commit, dirty-worktree state, scope and limitations, repository boundaries, generated/vendor exclusions, baseline commands, subsystems, and externally exposed or destructive workflows. 2. **Reconcile request and evidence** - Compare the requested audit with the grounded repository boundary using the reconciliation procedure in [references/audit-protocol.md](references/audit-protocol.md). Keep the gap ledger as temporary working state, not as a new bundle record. - Grill the user only on plan-changing gaps affecting categories, severity, pr