trace-to-skill v0.1.102

Adds project policy coverage to sensitive-audit for OpenAI Codex issue #2847 demand around deterministic sensitive-file exclusion.\n\nWhat changed:\n- sensitive-audit now reports whether project-level .codexignore, .agentignore, .aiexclude, and .gitignore exist\n- reports covered and missing recommended patterns without reading sensitive file contents\n- schema now exposes policyCoverage for downstream tooling\n- docs and OpenAI OSS brief mention sensitive-file policy coverage\n\nValidation:\n- npm run check\n- YAML workflow parse\n- git diff --check\n- npm pack --dry-run\n- synthetic sensitive-audit policy coverage proof\n- live openai/codex issue-map proof for #2847