Docs: bring the audit tutorial and CATALOG up to what audit 0.2.0 actually does

[mmcky]

Follow-through on #34. The tutorial is the procedure for run 2, and run 2 is the run that tests resume — so it is the one document that could not be left describing the pre-#34 behaviour.

Step 4 taught the resume rule that #34 replaced. It said to read findings.md and resume at the lowest number with no entry, which is exactly the single-block assumption defect 2 was about. It now describes partitioning issues.json by state and resuming each side independently, and it names the new failure mode worth watching for: resuming the open set correctly while re-doing the closed set from scratch. It also suggests interrupting during the closed pass if the chance comes, since that is the half that has never been checkpointed at all.

The same step quoted doctrine's old three-form citation list — file:line, a merged PR, or a tag — with no reachability rule, which is the drift Copilot caught inside doctrine on #34 surviving one file over. It now names the fourth form and, more importantly, the requirement that whatever is cited resolves on the ref the audit named.

Two review checks are strengthened where run 1 showed them weak. Check 3 passed a citation pointing at an unmerged branch, so it now says to resolve each sampled citation on the ref the header names, with git merge-base --is-ancestor for commits. Check 5 held in the report and broke in the checkpoint, so it now looks at findings.md as well as the output — closed entries reaching the catalog with no ## Closed block is precisely how run 1 passed that check in its report while failing it in its log.

CATALOG records the two severity-1 fixes. Its central caveat is unchanged and still true: resumability is untested, because run 1 was never interrupted.

reviews/audit-run-action-translation-2026-07-28.md is deliberately untouched — it is a dated record of what the doctrine said at the time, and correcting it would destroy the evidence that the defects were real.

Repo-level files only, so no plugin directory is touched and nothing bumps; check-version-bump.py agrees.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates repository-level documentation to reflect the behavior and expectations of audit as of 0.2.0 (post-#34), especially around phase-2 resumability/checkpointing and the “citations must resolve on the named ref” rule.

Changes:

• Update the audit tutorial’s Step 4 to describe per-state resuming (## Open / ## Closed) and the ref-resolvable citation requirement.
• Strengthen two post-run review checks in the tutorial (resolve sampled citations on the named ref; verify closed-side checkpointing via findings.md).
• Update CATALOG.md to note the two severity-1 fixes shipped in audit 0.2.0.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
docs/tutorial-run-an-audit.md	Updates Step 4 and review checks to match audit 0.2.0’s resume/checkpoint and citation-resolution behavior.
CATALOG.md	Notes that the two severity-1 defects addressed in #34 are fixed as of audit 0.2.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.