fix(ci): harden repository syntax audit and keep update CI source-only

[victorsteele]

PHASE-01 — F-001 + F-002

Baseline:

• App: v1.0.0.1.50.1
• Base commit: 92f87dd4d293c163b52fae2f4d97f84480fd775c

Head:

• Branch: fix/phase01-repository-syntax
• Head commit: aef6caf47fe6ea22d3ba9194d11b659fb8f58b15

Source changes

• Remove accidental invalid tracked ooudit.py artifact.
• Add repository-wide Python syntax verification for tracked and untracked/unignored source candidates.
• Purge generated repository bytecode before audit imports so stale timestamp-valid .pyc files cannot override source truth.
• Add regression coverage for tracked/untracked/ignored Python and stale-bytecode behavior.
• Keep normal update/fix/PR/merge CI source-only on Ubuntu and Windows.
• Gate wheel/Nuitka/portable/MSI/artifact/release build path to explicit v* release tags only.
• Add a regression contract preventing ordinary update/fix CI from re-enabling app builds.

Exact PR diff

• M .github/workflows/ci.yml
• D ooudit.py
• M scripts/test/audit.py
• A scripts/test/repository_syntax.py
• M tests/test_p14_distribution_pipeline.py
• A tests/test_repository_syntax.py

Verification

Local Windows:

• Repository syntax: 97/97 PASS
• Full audit: 651/651 PASS
• Repository privacy contract: PASS
• Provider visibility contract: PASS
• CI source-only regression: PASS

Push CI run 33020349685:

• Ubuntu test: SUCCESS — 651/651 PASS
• Windows windows-test: SUCCESS — 651/651 PASS
• windows-build: SKIPPED
• release: SKIPPED
• Workflow artifacts: 0

Frozen boundaries

No production src/**, storage schema/migration, provider/IVX, OAuth/onboarding, WorkerManager/QThread, task-state machine, Dynamic Tags, UI/UX, application version, package/release metadata, app build, or release behavior is changed outside the CI trigger policy described above.

Operating rule

Ordinary update/fix/PR/merge workflows perform source verification/tests only. App build/package/MSI/artifact/release execution is reserved for an explicit release-tag workflow.