v0.5.1 — self-audit defect fixes (D1–D6)

What changed

This release fixes six defects found by auditing the tool's own template
against 25 real arXiv cs.CL LaTeX sources — the corpus and the full
coverage matrix are in case-studies/arxiv-corpus/.

• D1 — neutral factory config. CHECKS_CONFIG shipped pre-filled with
  one specific paper's config, so a generic audit fired that paper's checks
  against any document. It now ships empty: the per-paper categories
  (C1/C2/C3/C6) report not applicable; C4's self-cite sub-check stays
  silent without a prefix. The generic checks still run on built-in defaults.
• D2 — "clean" is not "did not run". The summary distinguishes
  checked / not applicable / error per category.
• D3 — one crashed check no longer aborts the audit. A crash degrades
  that category to [ERROR] and the rest still run; exit code 2 now also
  covers a crashed check.
• D4 — BibTeX key regex. @\w+\{([^,]+), swallowed newlines, so a key
  on its own line was captured with its surroundings and cite keys that
  existed in refs.bib were reported missing. Replaced by
  @\w+\{\s*([^,\s]+)\s*, with regression tests.
• D5 — raw docstring. No more SyntaxWarning on import.
• D6 — C1 observation failures are errors, not findings. A missing
  abstract no longer files as a HIGH finding.

Verification

• 240 tests passing, 1 skipped (pytest -m "not slow"), pyflakes clean.
• The regression-injection meta-test is 45/45 effective, including
  "full suite returns rc=0 after all restores".
• CI: 8 jobs green.

Reproducing the audit

The v0.5.0 findings are kept verbatim. audit_corpus.py restores the
shipped v0.5.0 config on a v0.5.1+ template, so the config-driven defects
(D1/D2/D3) replay as recorded; D4 and D6 live in the function bodies and
cannot be restored by configuration — the script and the case-study README
say so explicitly.