Add built-in audit recipes for common .NET risk patterns

[Widthdom]

Found while dogfooding the locally built cdidx on branch codex/search-audit-issues-20260619.

Duplicate check: no open issue found for audit recipes AddWithValue new Regex CancellationToken.None GetAwaiter GetResult.

Evidence:

• Useful audit searches in this pass included AddWithValue, timeoutless new Regex( construction, CancellationToken.None, and sync-over-async via .GetAwaiter().GetResult().
• These patterns repeatedly surfaced actionable review candidates but required ad hoc query setup.

Problem:
The built-in recipe set should cover common .NET reliability/security patterns so future audits can start with a named recipe rather than rebuilding query strings.

Acceptance criteria:

• Add recipes for SQLite AddWithValue, regex construction without obvious timeout policy, CancellationToken.None in production paths, and sync-over-async.
• Include false-positive guidance and recommended labels for each recipe.
• Add snapshot coverage for the new recipes.

[Widthdom]

Work started on branch fix-issue3787-3714-3731-3710-3694-3693-3670-3696.