Summary

• add �udit-bundle --expect-profile for CI jobs that need profile mismatch failures without parsing JSON manually
• add �udit-bundle --policy strict as the first tiny built-in policy preset from SPEC-0020
• emit CI failure JSON for policy mismatches with stable failure classes and metadata-only output
• wire downstream CI recipe smoke to run --expect-profile --policy strict
• mark �udit-bundle-policy-controls done and move the usability-polish goal to downstream policy docs

Boundaries

• no broad policy DSL, remote policy loading, script execution, or repo-local proof execution
• no release prep, version bump, tag, or publish
• no new contract packs, provider compatibility claims, production security claims, or raw payload copying

Validation

• cargo fmt --all -- --check
• cargo test -p uselesskey-cli --all-features audit_bundle
• cargo test -p xtask external_adoption_smoke
• cargo +nightly xtask external-adoption-smoke --path . --ci-recipes
• cargo +nightly xtask pr-lite
• cargo clippy -p uselesskey-cli --all-targets --all-features -- -D warnings
• git diff --check