Trigger a current-state audit of one verifier against a repo

Starts an audit that judges a single verifier against the current tree of the repo behind a context lineage, producing a pass/fail/na verdict per candidate file (or one verdict over the whole path list for a paths-scope verifier).

Responds 202 with the run’s ids when started. A verifier with no resolved scope binding for this repo is not rejected: the run is created and the workflow resolves the binding before auditing. Rejects a diff-scope verifier, a resolved scope with no include globs, and a repo the org cannot read, each with a distinguishable 400/404. Responds 409 when an audit for the same verifier, repo, and ref is already running, and 429 when the org already has the maximum number of audits in flight.