Release audit gate for v0.2.0

[benzzy1287]

What

• add audit --git-tracked for the Git-index release file set
• add audit --strict so warnings fail CI
• detect OpenAI organization IDs, Slack tokens, Stripe live keys, JWTs, and non-example email addresses
• avoid echoing matched emails, usernames, or secret values
• update the plugin, skill, bilingual docs, changelog, and CI for v0.2.0

Why

A maintainer should be able to audit the files that will actually be published without unrelated untracked notes causing false positives. Release checks also need a fail-closed mode for privacy warnings.

Impact

• receipt schema remains codex-proofkit-receipt-v1
• normal audit behavior remains backward compatible
• no network calls, telemetry, credentials, or paid services are introduced

Verification

• python3 -m unittest discover -s tests -v — 10 passed
• python3 skills/prove-maintainer-work/scripts/proofkit.py audit . --git-tracked --strict — PASS, 0 errors, 0 warnings
• plugin validation — passed
• skill validation — passed
• ProofKit receipt verification — 17 checked, 0 failed