v0.3.5

Added

• ref-audit --sarif + a canonical Findings IR (scripts/_findings.py): SARIF 2.1.0 for GitHub code-scanning, the single seam future output formats render over. (R16)
• ref-audit --baseline / --write-baseline: adopt on a dirty vault, reporting and gating only NET-NEW debt; fingerprints are semantic so a rename does not resurrect the baseline. (R19)
• memory-consolidate --candidates: deterministic MERGE + CONTRADICTION candidate detection (a narrowing pre-filter for a gated judge). (R14)
• Reusable audit substrate (scripts/_audit.py): a tamper-evident hash-chained apply log any engine can write to; frontmatter-fix --audit-log is the first consumer. (R13 phase 1)