Add conservative audit baselines and local review annotations

[Widthdom]

Summary

Add audit baseline-export, baseline-compare, and baseline-review using the existing audit recipe engine. Local, versioned baselines store evidence hashes and review provenance without source snippets. Comparisons report bounded new/unchanged/resolved/unknown groups and preserve unknown outcomes when coverage, scope, workspace identity, or evidence cannot support resolution.

Baseline files use bounded parsing and atomic private writes with explicit overwrite. Review decisions apply only to unchanged compatible evidence. CLI help/completions, English/Japanese README and developer/testing guidance, and JSON contract snapshots are included.

Validation

• 340 baseline, audit-all/progress, JSON contract inventory, CLI schema/completion/help, and relevant regression tests passed on each of net8.0 and net9.0 after merging current main.
• The broad run started before the final manifest fix/main merge completed: net8.0 had 12,256 passed / 9 skipped / 1 failed; net9.0 had 11,767 passed / 435 skipped / 1 failed. In both frameworks the sole failure was GoldenJsonPayloads_AreUniqueAndCheckedIn_Issue4166: the two new snapshots were not yet registered. Registration is fixed, and that test plus the affected baseline/audit/help contracts passed in the 340-test run above. No full-suite pass is claimed for the final merged commit.
• dotnet build -p:UseSharedCompilation=false.
• dotnet format CodeIndex.sln --verify-no-changes --no-restore.
• dotnet run --project tools/CodeIndex.Changelog -- check.
• Local CLI export/compare smoke and root/shared-workspace freshness checks.
• Two rounds of Codex adversarial review; all four first-round findings were addressed with regression coverage. Final result: No blocking/actionable issues found.

Changelog fragment: changelog.d/unreleased/5261.added.md.

Fixes #5261