Add codebase audit workflow with preset topics

Adds a workflow_dispatch-triggered codebase audit system that can analyze
existing code (not just PR diffs) using multi-perspective AI review.

Key features:
- Smart file discovery: knowledge files → grep → LLM reranking
- Multi-pass analysis: per-file clusters, then cross-file synthesis
- Snippet-based citing: exact code quotes instead of line numbers
- Rolling issues: updates existing issue for same topic
- 5 preset audit topics: panic-safety, ffi-boundary, security-hardening,
  undefined-propagation, resource-limits
- Auto-selects perspectives based on topic keywords

New files:
- .github/workflows/codebase-audit.yml
- .github/scripts/codebase-audit.sh
- .github/prompts/audit-*.json (5 preset configs)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: anakrish

.github/prompts/audit-ffi-boundary.json

@@ -0,0 +1,5 @@
+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",
+  "perspectives": "security-auditor,architect,api-steward,reliability-engineer",
+  "description": "Audits all FFI bindings (C, Python, Ruby, Java, Go, C#, WASM) for safety invariants."
+}

.github/prompts/audit-panic-safety.json

@@ -0,0 +1,5 @@
+{
+  "topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",
+  "perspectives": "reliability-engineer,security-auditor,semantics-expert",
+  "description": "Finds all potential panic points in non-test code. Critical for a no_std-compatible library used in Azure production."
+}

.github/prompts/audit-resource-limits.json

@@ -0,0 +1,5 @@
+{
+  "topic": "resource limits and DoS protection — enforce_limit usage, recursion depth, output size caps, timeout handling, and memory bounds",
+  "perspectives": "security-auditor,reliability-engineer,performance-engineer",
+  "description": "Ensures all code paths that could consume unbounded resources are properly guarded."
+}

.github/prompts/audit-security-hardening.json

@@ -0,0 +1,5 @@
+{
+  "topic": "security hardening — input validation, resource limits, DoS protection, untrusted policy handling, and supply chain safety",
+  "perspectives": "security-auditor,red-teamer,reliability-engineer",
+  "description": "Comprehensive security review of the policy engine. Focuses on attack surfaces exposed to untrusted inputs."
+}

.github/prompts/audit-undefined-propagation.json

@@ -0,0 +1,5 @@
+{
+  "topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",
+  "perspectives": "semantics-expert,test-engineer,reliability-engineer",
+  "description": "Verifies correct Undefined/three-valued logic handling throughout the evaluation pipeline. Rego's most subtle semantics."
+}