fix(07-04): golden-corpus treats an npm-root-less cwd as environment drift (notRun, exit 2) + the AU1 placeholder regex pin

- a missing package.json in the audit root is T-07-22's environment-drift class,
  not a corpus failure — the corpora cannot even be spawned there
- AU1's flag-skip assertion matches the printed 'NOT RUN — (pass --live)' shape

scripts/lib/budget-gates.mjs

@@ -504,11 +504,17 @@ export function runGoldenCorpusGate(opts = {}) {
 
   const parts = [];
   const failures = [];
+  const cwd = opts.cwd ?? REPO_ROOT;
+  if (!existsSync(path.join(cwd, "package.json"))) {
+    // Environment drift, not a corpus failure: the corpora are npm scripts —
+    // without the root manifest they cannot even be spawned (T-07-22 class).
+    return notRun(id, "package.json is absent in the audit root — the golden corpora cannot be spawned");
+  }
   for (const [corpusId, argv] of commands) {
     let res;
     try {
       res = spawnSync(argv[0], argv.slice(1), {
-        cwd: opts.cwd ?? REPO_ROOT,
+        cwd,
         encoding: "utf8",
         timeout: 300000,
         maxBuffer: 1 << 26,
@@ -525,7 +531,6 @@ export function runGoldenCorpusGate(opts = {}) {
       parts.push(`${corpusId} exit 0`);
     }
   }
-
   const evidence =
     failures.length === 0
       ? `golden corpora re-run by THIS gate (child processes): ${parts.join("; ")} — SC4.a + SC4.b proven by the same command that produces the record`