feat(07-03): the privacy-audit CLI + root npm script — orchestration, evidence report, 0/1/2 exit codes

- runs the five static gates in Pattern-4 order; --live adds the KV-expiry
  and asset-header probes; the no-flag skip prints '(pass --live)' and is
  never silently green
- exit 0 CLEAN / 1 FAILED (violations counted across gates) / 2 NOT RUN
  (credentials or build or deployment drift — never mistaken for a pass)
- header states the maintainer-time-tool law, the GPL fork-reuse contract,
  and D-02's zero-telemetry prove-the-absence posture
- AU1-3 CLI vectors green: CLEAN exit 0 on this tree, FAILED exit 1 via the
  PRIVACY_AUDIT_ROOT fixture, NOT RUN exit 2 for --live without credentials

package.json

@@ -16,6 +16,7 @@
     "sheet": "npm run sheet --workspace theme",
     "gallery": "npm run gallery --workspace theme",
     "audit": "npm run audit --workspace theme",
+    "privacy-audit": "node scripts/privacy-audit.mjs",
     "capture": "npm run capture --workspace theme",
     "bot:test": "npm test -w bot",
     "bot:typecheck": "npm run typecheck -w bot",