Forge cross-vendor audit silently bundles zero source for any non-TypeScript project

[xmasyx]

What happens

CrossVendorAudit.ts — the Forge audit tool, the one the Algorithm elects at E4/E5
VERIFY — builds the bundle it hands to codex exec by extracting file paths from
the ISA's ## Decisions section:

// LIFEOS/TOOLS/CrossVendorAudit.ts:124
const pathPattern = /`([~/][^\s`]+\.(?:ts|md|json|yaml|yml|tsx|jsx|js|txt))`/g;

The extension list is TypeScript-only. For a project written in any other
language — Swift, Python, Rust, Go, Java, C — no path ever matches, so
readArtifacts() returns "(no file references found in ## Decisions)" and the
bundle that reaches the auditor contains the ISA prose and nothing else.

GrokAudit.ts:144 carries the same line and has the same behaviour.

Why it matters

The audit still returns a verdict. It reads like a code review, it is logged as a
code review, and it is used to gate high-blast-radius work — but the auditor never
saw a line of the code. The degradation is completely silent: no warning, no
non-zero exit, nothing in the verdict JSON that distinguishes "I reviewed 4000
lines" from "I reviewed a spec document".

This is worse than a hard failure, because a skipped audit is visible and this one
is not.

Reproduce

1. Write an ISA whose ## Decisions section references source files of a
   non-TypeScript project, e.g. `~/path/to/App/Sources/App/Main.swift`.
2. Run bun LIFEOS/TOOLS/CrossVendorAudit.ts --slug <slug>.
3. The bundle's artifacts section reads (no file references found in ## Decisions).
4. A verdict comes back anyway.

Proposed fix

Widen the extension list. One line, no behaviour change for TypeScript projects:

const pathPattern =
  /`([~/][^\s`]+\.(?:ts|md|json|yaml|yml|tsx|jsx|js|txt|swift|py|rs|go|java|kt|c|h|cc|cpp|hpp|m|mm|rb|php|sh|sql|toml))`/g;

The same line exists in GrokAudit.ts and needs the same change.

Worth considering as a follow-up

Even with the list widened, "the ISA named files and none of them were bundled" is
a condition the caller should be able to see. Returning the count of bundled
artifacts in the verdict JSON — or refusing to produce a verdict when a
## Decisions section contains backticked paths and zero of them made it into the
bundle — would turn the remaining silent case into a loud one.