Summary

• Adds class-specific �udit-bundle diagnostics for CI and interactive failures.
• Keeps stable JSON failure classes and the schema shape unchanged.
• Preserves metadata-only audit output and adds regression coverage for actionable path_escape details plus diagnostic mapper mutation coverage.

Files added/changed

• .uselesskey/goals/active.toml
• crates/uselesskey-cli/src/main.rs
• crates/uselesskey-cli/tests/cli.rs

Validation

• cargo test -p uselesskey-cli --all-features bundle_audit_failure_diagnostics_are_class_specific
• cargo test -p uselesskey-cli --all-features audit_bundle
• cargo xtask mutants-pr --changed
• cargo xtask no-blob
• cargo +nightly xtask pr-lite
• cargo fmt --all -- --check
• git diff --check

Non-goals

• No release prep, version bump, tag, or publish.
• No new contract packs or badges.
• No provider compatibility, production security, or scanner-evasion claims.
• No raw fixture payload copying into audit diagnostics or receipts.

What this enables next

• Downstream CI users get stable machine classes plus copyable remediation text before the installed CLI doctor slice.