[AUDIT-PROGRAM-001] Commission external security audit

[JROChub]

Commission external audit engagement and lock signed SOW.

SLA target: 2026-03-05

Checklist:

• Candidate audit firms contacted
• Proposals collected and compared
• SOW signed
• Audit kickoff date scheduled
• Tracker updated with evidence URL

References:

• docs/audit/README.md
• docs/audit/rfp.md
• docs/audit/outreach_email_templates.md
• docs/audit/fix_sla_tracker.tsv