ci: harden audit source archive

[roger-gan]

Description

Harden both audit workflow paths so archives sent to the external audit service cannot contain persisted GitHub credentials, Git metadata, or untracked runner files. The archive is built from the checked-out PR commit and validated against the complete tracked-file manifest to prevent export-ignore and export-subst audit bypasses.

Tests

• Parsed .github/workflows/audit-pr.yml as YAML.
• Ran both extracted archive shell blocks successfully.
• Verified the ZIP is readable and contains exactly all 1226 tracked files.
• Verified the ZIP excludes .git and untracked workspace files.
• Ran shell syntax validation and git diff --check.
• Completed an independent security bypass and regression review with no remaining findings.

Branch route

• Normal development targets develop
• Only release_* or hotfix/* targets main

Checklist

• Workflow syntax and focused validation pass
• No publishable package changes; no Changeset required
• Only .github/workflows/audit-pr.yml is changed