feat: audit-of-audit sampling rules (golden set and critical paths)

- cloud/audit_sampling.py (pure, stdlib): mandatory sampling (1.0)
  for rebuild cases and for third-failure near-complete cases whose
  continuation round still failed; random sampling for the rest
  (normal 0.10, critical-path 0.50, ceil so small groups are never
  rounded to zero, seed required and recorded for reproducibility).
- Wrong-verdict handling: correct the original conclusion and
  retrigger the corresponding flow (wrong pushback ->
  cancel_pushback_and_rerun_audit; wrong rebuild ->
  halt_rebuild_and_restore; wrong pass -> reopen_audit_and_pushback;
  unknown original -> escalate_to_human); every result, correct or
  corrected, is appended to the audit-of-audit record.
- Golden-set approval checklist: list reviewed, criteria defined,
  sample exclusion, approver+timestamp -- all human-confirmed before
  approval; sample entries (sample=True or sample- ids) are dropped
  and counted, never counted as golden.
- metrics.build_report gains an optional sampling_plan section;
  without a plan it states sampling is pending, never implying the
  audit was re-examined.

cloud/metrics.py

@@ -206,7 +206,7 @@ def evaluate_feedback(metrics, thresholds=None, check_stats=None):
 
 def build_report(metrics, golden=None, thresholds=None,
                  thresholds_source="default_unapproved",
-                 check_stats=None):
+                 check_stats=None, sampling_plan=None):
     """Assemble the JSON report document.
 
     ``golden``: None, or a dict with ``tasks`` (list of task ids),
@@ -245,6 +245,15 @@ def build_report(metrics, golden=None, thresholds=None,
         # (arch_conformance.check_contract_version) with coordinator
         # approval, never by auto-applying an action record.
         "feedback_consumers": ["routing", "audit_standards"],
+        # Audit-of-audit sampling (cloud/audit_sampling.py): when a
+        # plan is supplied it is carried verbatim; otherwise the
+        # report states sampling is pending rather than implying
+        # the audit was re-examined.
+        "sampling": sampling_plan or {
+            "status": "pending",
+            "note": "no audit-of-audit sample plan supplied; audit "
+                    "verdicts in this report have not been "
+                    "re-examined"},
     }