Publish the reusable repository and organization checkpoint-audit contract

[szmyty]

Why

Ego Hygiene has already proven a useful evidence-backed repository audit format in egohygiene#315 and egohygiene#317, but the reusable contract still lives in the product repository.

Aether should own the portable specification and agent/skill behavior so repository and organization checkpoints can be produced consistently without coupling the harness to one application.

Scope

• Extract and version the reusable audit contract, agent guidance, and skill behavior.
• Support both a single-repository profile and an organization/portfolio profile.
• Define immutable observation metadata: timestamp, repository, revision, scope, tools, limitations, and evidence references.
• Preserve finding dimensions such as severity, confidence, status, effort, impact, recommendation, dependencies, and positive observations.
• Define delta semantics so a later checkpoint can distinguish new, unchanged, improved, regressed, and resolved findings.
• Keep collection read-only by default; issue creation and repository mutation must be explicit downstream actions.
• Include privacy, secret-redaction, provenance, and generated-artifact requirements.
• Provide fixtures/examples derived from the prior Ego Hygiene audits without retaining product-specific assumptions.

Acceptance criteria

• A versioned checkpoint-audit specification exists in Aether.
• Repository and organization profiles are both defined.
• The report schema, evidence model, finding lifecycle, and delta model are machine-readable.
• Reusable agent/skill guidance is published from the same source of truth.
• Validation fixtures cover valid reports, stale evidence, missing provenance, and malformed findings.
• Ownership boundaries for Hygiene, EgoLint, Relay, Pace, Observatory, Holon, and Empathy are documented.
• Migration guidance identifies what should be removed or replaced in the product repository after adoption.

Dependencies and consumers

• Source material: egohygiene#315, egohygiene#317
• Validation consumer: EgoLint
• Execution consumer: Relay
• Fleet adoption: Pace
• Portfolio read model: Observatory
• Policy/profile owner: Hygiene

Out of scope

• Automatically filing or closing GitHub issues
• Mutating repositories during collection
• Treating heuristics as verified facts