audit: independent audit role, auto-pushback, rebuild branch, three tightenings, QA full-chain

Independent audit (no code, independent re-run, separate signature;
CONDITIONAL never passes; deviation needs due todo) and automatic
pushback (fail -> derived fix subtask, merge/release blocked,
package with per-item evidence, full re-audit, 3-round limit with
a separate CI auto-fix counter, ledger hash-chain interface for
track 4, gate-block interface for track 1). Over 3 failures per
module per contract version: rebuild only that module from the
frozen contract (old implementation archived, avoidance list),
contract/design root cause -> G2 re-freeze escalation instead.
Tightenings: 3rd-failure triage (structural early rebuild /
early refreeze, near-complete one targeted round), rebuild keeps
tests and passed assets with an old-test first gate, audit-of-
audit sampling/correction and G6 user-only acceptance plus
acceptance-rebuild user confirmation. QA full chain: self-test
three parts, PRD coverage, agent six, cross-client matrix with
honest uncompiled verdicts, G5 gates, impact-scoped regression,
dual QA/audit signatures, failed-link re-runs in re-audit.
Skill text is purely additive (+459/-0) against main v0.2 text;
port this section into v0.3/v0.4/v0.5 texts on merge, never
overwrite them with this file.

cloud/skills/software-engineering/tools/check_appendix.py

@@ -10,10 +10,10 @@ source, then re-issue the appendix through the skill's own track),
 never a silent rewrite by this script.
 
 What it checks, in order:
-  1. SKILL.md contains the appendix intro and exactly the eleven
-     chapters 00..10, in order, each with a source note naming its own
+  1. SKILL.md contains the appendix intro and exactly the twelve
+     chapters 00..11, in order, each with a source note naming its own
      templates/roles/<id>.md file.
-  2. templates/roles/ contains exactly those eleven source files:
+  2. templates/roles/ contains exactly those twelve source files:
      a missing source fails, an unexpected extra file fails.
   3. Each source, in canonical form, equals the matching appendix
      chapter in canonical form (see canonical() below).
@@ -29,7 +29,7 @@ and its appendix chapter -- anything else is a failure):
   b. One inter-chapter separator line "---": in the current SKILL.md
      it appears after chapters 01/02/03/05/06/09 only. Chapters
      00/04/07 end with their GitHub subsection and run straight into
-     the next heading with no separator, and 10-iteration is the end
+     the next heading with no separator, and 11-auditor is the end
      of file.
      The check strips at most one trailing separator; it does NOT
      normalise SKILL.md to a uniform separator, so the current
@@ -64,7 +64,8 @@ from pathlib import Path
 EXPECTED_IDS = ["00-coordinator", "01-product-manager", "02-architect",
                 "03-designer", "04-client-developer", "05-backend",
                 "06-qa", "07-acceptance", "08-shared-core",
-                "09-ops", "10-iteration"]
+                "09-ops", "10-iteration",
+                "11-auditor"]
 
 CHAPTER_RE = re.compile(
     r"^## 附录角色：(\d{2}-[a-z0-9-]+)"