feat: upstream_fix marker convention for upstream bug fixes

[anandgupta42]

Problem

When we fix bugs in upstream code, the current marker system treats them the same as feature additions. During upstream merges, reviewers can't distinguish "temporary bug fix that upstream may have already fixed" from "permanent feature we added". This leads to:

1. Keeping our fix AND upstream's fix (duplicate/conflict)
2. Not knowing when to drop our markers after upstream ships their own fix
3. No easy way to audit what upstream bugs we're carrying

Solution

1. upstream_fix: tag convention in marker descriptions to distinguish bug fixes from features
2. --audit-fixes flag on analyze.ts to list all upstream bug fixes before each merge
3. Documentation with when-to-use-which guidance

Also includes code review fixes from #546 that weren't included in the merge.