Release 2.12: source-bound rework delta audits

[avksp]

Summary

• add source-bound delta audits for rework attempts and dependency-impact classification
• enforce finding/reproduction lineage, deterministic fallback, and final implementation-audit completeness
• publish Release 2.12 contracts, CLI/docs, economics evidence, and version surfaces

Validation

• python3 -m unittest discover -s tests -t .: 2143 tests passed, 1 platform skip
• security suite: PASS
• Python quality producer/validator: PASS
• statement coverage 81.98%, branch coverage 66.42%
• repository hygiene/history, module acyclicity, workflow transitions, stdlib boundary, architecture complexity, docs compatibility: PASS
• neutrality scan: 0 findings
• publication versions/adoption and frozen-plan gates: PASS
• dual independent exact-candidate final audit: ACCEPTED (OpenCode Mimo and OS-sandboxed OpenCode GLM-5.3-Flash)

Residual

• one pre-existing LOW finding: unreachable duplicate _add_audit_parser helper in cli/lifecycle_parsers.py; no runtime effect and outside this release authority
• PyPI deployment remains a separate manual environment approval and does not block GitHub release creation after merge

[avksp]

Post-CI correction is complete.

• First matrix exposed one cross-platform fail-open test failure on all Windows versions: C:/... was host-relative under Path semantics.
• Commit d05af74 now rejects POSIX, Windows drive-letter, and UNC absolute source identities via host-independent PurePosixPath/PureWindowsPath checks.
• Local full suite: 2143 passed, 1 platform skip. Security, quality, architecture, docs, neutrality, publication, and frozen-plan gates: PASS.
• Re-run GitHub matrix: 22/22 SUCCESS, including Windows Python 3.11-3.14.
• Exact-commit independent audits: OpenCode Mimo ACCEPTED; OS-sandboxed OpenCode GLM-5.3-Flash ACCEPTED. GLM required fresh final artifacts after the correction; the supplemental implementation aggregate, final audit, and final proof were regenerated and its recheck closed AUD212-F1.
• Residual remains one pre-existing LOW dead helper finding with no runtime impact.

No PyPI approval is required before merge or GitHub Release creation.