Trigger a current-state audit of one verifier against a repo

Starts an audit that judges a single verifier against the current tree of the repo behind a context lineage, producing a pass/fail/na verdict per candidate file (or one verdict over the whole path list for a paths-scope verifier).

Responds 202 with the run’s ids when started. A verifier with no resolved scope binding for this repo is not rejected: the run is created and the workflow resolves the binding before auditing. Rejects a diff-scope verifier, a verifier whose current version is unavailable, a resolved scope with no include globs, and a repo the org cannot read, each with a distinguishable 400/404. Responds 409 when an audit for the same verifier, repo, and ref is already running, and 429 when the org already has the maximum number of audits in flight. Authored verifiers also require declarationId, which selects one live configured group and keeps groups over the same verifier definition independent.

mode: more judges matched files the saved coverage has not examined. mode: retry judges again only the files whose saved result failed for a retryable reason (a read or judge failure), keeping every judged file. Both continue from afterRunId and need the scan-more entitlement.