audit: independent audit role, auto-pushback, rebuild branch, three tightenings, QA full-chain

Independent audit (no code, independent re-run, separate signature;
CONDITIONAL never passes; deviation needs due todo) and automatic
pushback (fail -> derived fix subtask, merge/release blocked,
package with per-item evidence, full re-audit, 3-round limit with
a separate CI auto-fix counter, ledger hash-chain interface for
track 4, gate-block interface for track 1). Over 3 failures per
module per contract version: rebuild only that module from the
frozen contract (old implementation archived, avoidance list),
contract/design root cause -> G2 re-freeze escalation instead.
Tightenings: 3rd-failure triage (structural early rebuild /
early refreeze, near-complete one targeted round), rebuild keeps
tests and passed assets with an old-test first gate, audit-of-
audit sampling/correction and G6 user-only acceptance plus
acceptance-rebuild user confirmation. QA full chain: self-test
three parts, PRD coverage, agent six, cross-client matrix with
honest uncompiled verdicts, G5 gates, impact-scoped regression,
dual QA/audit signatures, failed-link re-runs in re-audit.
Skill text is purely additive (+459/-0) against main v0.2 text;
port this section into v0.3/v0.4/v0.5 texts on merge, never
overwrite them with this file.

cloud/tests/test_skill_appendix_sync.py

@@ -57,7 +57,8 @@ SKILL_PATH = (REPO_ROOT / "cloud" / "skills" / "software-engineering"
 EXPECTED_IDS = ["00-coordinator", "01-product-manager", "02-architect",
                 "03-designer", "04-client-developer", "05-backend",
                 "06-qa", "07-acceptance", "08-shared-core",
-                "09-ops", "10-iteration"]
+                "09-ops", "10-iteration",
+                "11-auditor"]
 
 # Chapter -> keywords that chapter must carry for the GitHub guarantee
 # the body claims is "同样写进了附录的协调员、客户端、验收章节".