fix: align live E2E and audit bundle tooling post-remediation

[codethor0]

Summary

• Update live_e2e_validation.py to expect pending reports to be hidden from public GET (404) while remaining visible to the authenticated reporter (200), and to expect vote rejection (422) on non-public reports.
• Fix create_audit_bundle.py hygiene scanner false positives on contributor onboarding policy text and on the scanner source itself.
• Add regression coverage for bundle hygiene scanning.

Context

Post-merge validation of PR #36 remediation at 973432aa1e0d35dfbc40f13481d4d8160194fe15 found no product regressions (219 pytest passed, migrations passed, main CI passed). The live E2E script and audit bundle tooling were stale relative to intentional remediation behavior.

Test plan

• python3.11 scripts/live_e2e_validation.py --skip-public-mvp passes locally
• python3.11 scripts/create_audit_bundle.py completes without hygiene failures
• python3.11 scripts/test_audit_bundle_packaging.py passes

Made with Cursor

[codethor0]

Repository owner authorization: temporarily relaxing the required CODEOWNERS review and approval-count settings solely to merge this narrowly scoped operational-validation follow-up. All required CI checks are green, the three-file diff has been reviewed, live E2E passes 26/26, and audit-bundle validation passes. The exact original review-protection configuration will be restored immediately after the squash merge. Required status checks, administrator enforcement, CODEOWNERS, repository rulesets, and all other branch protections will remain unchanged.

[codethor0]

Controlled merge completed. PR #37 was squash-merged after the repository owner temporarily disabled the CODEOWNERS review requirement and set the approval count to zero. The exact original review protection was restored immediately and verified against the pre-change snapshot. Required status checks, administrator enforcement, CODEOWNERS, rulesets, and all other branch protections remained unchanged.