feat(audit): selftest in pytest gate (static-scoped, no recursion) + opt-in git hooks + README

feat(audit): core contract + runner + CLI