fix(07-04): golden-corpus treats an npm-root-less cwd as environment drift (notRun, exit 2) + the AU1 placeholder regex pin

- a missing package.json in the audit root is T-07-22's environment-drift class,
  not a corpus failure — the corpora cannot even be spawned there
- AU1's flag-skip assertion matches the printed 'NOT RUN — (pass --live)' shape

scripts/lib/budget-gates.mjs

@@ -504,11 +504,17 @@ export function runGoldenCorpusGate(opts = {}) {
 
   const parts = [];
   const failures = [];
+  const cwd = opts.cwd ?? REPO_ROOT;
+  if (!existsSync(path.join(cwd, "package.json"))) {
+    // Environment drift, not a corpus failure: the corpora are npm scripts —
+    // without the root manifest they cannot even be spawned (T-07-22 class).
+    return notRun(id, "package.json is absent in the audit root — the golden corpora cannot be spawned");
+  }
   for (const [corpusId, argv] of commands) {
     let res;
     try {
       res = spawnSync(argv[0], argv.slice(1), {
-        cwd: opts.cwd ?? REPO_ROOT,
+        cwd,
         encoding: "utf8",
         timeout: 300000,
         maxBuffer: 1 << 26,
@@ -525,7 +531,6 @@ export function runGoldenCorpusGate(opts = {}) {
       parts.push(`${corpusId} exit 0`);
     }
   }
-
   const evidence =
     failures.length === 0
       ? `golden corpora re-run by THIS gate (child processes): ${parts.join("; ")} — SC4.a + SC4.b proven by the same command that produces the record`

scripts/test/budget-audit.test.mjs

@@ -287,7 +287,7 @@ await test("AU1 without --live: every required gate prints its evidence line, th
   assert.match(out, /50\/request/, "the subrequest ceiling must appear in the comparison table");
   assert.match(out, /10 ms\/invocation/, "the CPU ceiling must appear in the comparison table");
   assert.match(out, /not measured/, "unmeasured ceilings must read `not measured` — never 0");
-  assert.match(out, /cache-headers: NOT RUN \(pass --live\)/, "the flag-skipped live gate is visible and honest");
+  assert.match(out, /cache-headers: NOT RUN.*\(pass --live\)/, "the flag-skipped live gate is visible and honest");
 });
 
 await test("AU2 with --live: the live header probe runs and the exit contract holds — a NOT RUN cache-header gate NEVER coexists with exit 0", () => {