Add audit subcommand help

[heznpc]

Summary

• make rulemeter audit --help and rulemeter audit -h exit 0 with subcommand help
• document the actual audit --json review keys, including candidates for duplicate candidates
• clarify that corpus validation labels are added from findings[] fingerprints

User-perspective test

• opened a separate Codex thread as a first-time RuleMeter user
• that flow found audit --help returning UNKNOWN_FLAG and JSON key discoverability gaps
• similar detection and fail-on flows worked, with the expected lexical/non-semantic limitation

Verification

• npm test
• npm run validate:corpus
• node dist/cli.js audit --help
• node dist/cli.js audit -h
• npm run dogfood
• npm run pack:check
• npm run smoke:install
• npm audit --audit-level=high