fix: restore local build and audit gate checks [AI-assisted]

[artemgetmann]

Review Fast Path

• User path fixed: local validation no longer fails immediately on the idle-flush build error, the non-hermetic security audit test, or the consumer-doc formatting drift.
• Proof: pnpm build passes; pnpm test -- src/security/audit.test.ts -t "flags extensions without plugins.allow" passes; pnpm format:check passes inside pnpm check before tsgo runs.
• Shared-state footgun removed: security audit plugin trust checks can now use injected audit env instead of reading the developer shell directly, so the audit test no longer depends on ambient token env.
• Still hurts: pnpm check now gets past formatting and exposes a large unrelated tsgo/type-error baseline across other files.

Why This Matters

• The original red gates were partly fake failures caused by drift and environment leakage.
• This PR restores the specific local failures we observed without pretending to solve the entire repo-wide type backlog.

Scope Boundary

• Fixes the missing skipWaitForIdle cleanup option.
• Makes plugin-trust audit env handling deterministic.
• Makes the failing audit test hermetic.
• Reformats the four consumer docs that were blocking format:check.
• Does not attempt to fix the unrelated repo-wide tsgo failures surfaced afterward.

Verification

• pnpm build ✅
• pnpm test -- src/security/audit.test.ts -t "flags extensions without plugins.allow" ✅
• pnpm check status:
  • format:check ✅ after this PR
  • tsgo ❌ still fails on unrelated pre-existing errors outside this diff

AI Assistance

• AI-assisted
• Testing degree: targeted