Final child issue of the #2433 hardening epic. Adds a composite audit
workflow that runs ONLY on upstream sync PRs — re-invokes the universal
H7/H8/H9 gates with verbose reporting and aggregates their verdicts into
a single reviewer-facing check.

The underlying H7/H8/H9 gates are already enforced on every PR via
ci.yml. This workflow is additive reporting — it does not bypass or
replace any existing gate. Value-add is purely UX: reviewers triaging a
500-to-2500-commit sync PR get all three audit verdicts + an attestation
diff in one place, instead of hunting through 7 separate CI jobs.

Scope:
- .github/workflows/sync-pr-audit.yml (128 LOC): triggers on PR title
  prefix `sync:`; runs H7 strict + inventory, H8, H9, and H9 diff in
  sequence with continue-on-error + if:always() so failures don't
  short-circuit the composite view
- scripts/check-attestations-diff.mjs (184 LOC): AST-parses
  MODULE_ATTESTATIONS at base and head via TypeScript compiler, reports
  per-entry category transitions in markdown tables. Uses shared
  ts-guard-utils helpers (isTestLikeTypeScriptFile, unwrapExpression).
- CONTRIBUTING.md § Sync PR workflow: documents trigger semantics,
  report composition, branch-protection caveat

Branch protection posture: advisory by default. GitHub branch protection
treats skipped required checks as blocking, so this workflow cannot be a
blanket required check. Recommended path: GitHub Rulesets with
conditional requirements (required only when PR title matches `sync:*`).
The underlying H7/H8/H9 gates on ci.yml remain enforced universally, so
merge is still blocked when they fail.

Validation (fresh-context subprocess, session 346848b0) initially found
5 blockers + 1 non-blocking:
1. Broken awk script → replaced with AST-parsing check-attestations-diff.mjs
2. bash `set -e` / pipefail broke exit-code capture → continue-on-error + if:always()
3. Missing CONTRIBUTING.md section → added
4. Branch-protection interaction undocumented → documented in workflow header + CONTRIBUTING.md
5. Unused pull-requests:write permission → dropped
(+ non-blocking stale awk comment in workflow → also fixed)

All addressed; re-validated CLEAN.

Polish (fresh-context subprocess, session 2811e6be): CLEAN after 3
iterations. Net -30 LOC (-7%) via DRY refactors:
- Diff script: reused isTestLikeTypeScriptFile + unwrapExpression from
  ts-guard-utils (eliminated duplicate test-suffix filter + AST unwrap)
- Merged Composite summary + Composite exit into single step
- Dropped broken h9_diff row in summary (diff is advisory, not gated)
- Extracted shared failure condition to single $failed variable
- Aligned convention with sibling scripts (runAsScript vs direct main)

Dry-run verification:
- `node scripts/check-attestations-diff.mjs 028566c 511ae3a`
  correctly reports all attestation additions from the #2437 landing
  commit (93 modules × up to 28 symbols each)
- `node scripts/check-attestations-diff.mjs main main` correctly reports
  "No attestation changes between base and HEAD"
- Real dry-run on a future sync PR: will verify after merge

Closes #2441. With this, all 4 active-path child issues of
the #2433 epic (H7 via #2435, H8 via #2436, H9 via #2437, H10 via
this PR) are delivered.

HQ ADR 0005 H10 update + epic closure notes will follow in a companion
HQ commit.