Summary

• Adds uselesskey audit-bundle --ci so downstream CI can consume metadata-only audit JSON and rely on process exit status.
• Emits stable failure JSON plus audit failed: <failure_class> on stderr when an audit fails.
• Updates the bundle-audit JSON schema/reference docs and file policy for the published schema artifact.

Files added/changed

• crates/uselesskey-cli/src/main.rs
• crates/uselesskey-cli/tests/cli.rs
• docs/schemas/bundle-audit.schema.json
• docs/reference/bundle-audit-json.md
• policy/non-rust-allowlist.toml
• .uselesskey/goals/active.toml

Validation

• cargo test -p uselesskey-cli --all-features audit_bundle
• cargo run -p uselesskey-cli -- bundle --profile webhook --out target/audit-test/ci-webhook
• cargo run -p uselesskey-cli -- audit-bundle --path target/audit-test/ci-webhook --ci
• cargo xtask external-adoption-smoke --path . --format json
• cargo xtask no-blob
• cargo xtask check-file-policy
• cargo xtask docs-sync --check
• cargo xtask typos
• cargo +nightly xtask pr-lite
• git diff --check

Non-goals

• No version bump, tag, publish, release prep, new badge, new contract pack, provider compatibility claim, production security claim, or claim-ledger execution from the installed CLI.

What this enables next

• Downstream CI can fail on stable audit failure classes without parsing human output, which sets up GitHub Actions recipes and failure-message polish.