fix: remove .ai directory and harden discovery, runner temp file cleanup, and report line endings

[Mresyzz]

Summary

1. Completely remove .ai/ directory from repository and ignore .ai/ in .gitignore.
2. Discovery readability probe: is_shell_script now probes read access first, preventing unreadable files from being returned as candidates.
3. Temp file leak prevention: wrapped run_on_distro post-preparation code in try-finally to guarantee own_temp_file cleanup on any error.
4. Matrix preflight check: run_matrix validates script existence and rejects directories before Docker daemon connection and thread pool creation.
5. Consistent POSIX LF: publish_output enforces newline='\n' across platforms.

Verification

• Added 4 targeted tests in tests/test_audit_coverage.py.
• Full pytest suite passes: 205 tests (193 passed, 12 skipped, 0 failures).