docs: record the META-236 vendor-notice change, and fix stale paths

[qmarcelle]

META-247's ruling required the vendor-notice change to carry "its own evidence and announcement." The evidence landed — parity receipt, a recorded entry in migration/parity-expected-differences.txt, a separate commit. The announcement did not: agents-audit's [Unreleased] section had the two META-157 items and nothing for META-236.

The announcement

Two entries added to packages/agents-audit-compat/CHANGELOG.md:

• the scan output change, stating plainly that exit codes are unchanged and scan --json is byte-identical, so nothing consuming machine-readable output is affected;
• the added renderMissingArtifactNotice export, and that renderVrekoUpsell remains exported and unchanged — additive, nothing removed.

Four stale references found while sweeping. One was a real break.

1. scripts/verify-published.mjs was throwing on startup. It read ../packages/agents-audit/package.json for the release version — a path that stopped existing in META-247:

node:fs:441
    return binding.readFileUtf8(path, stringToFlags(options.flag));

It is only invoked from the disabled release path, so it was latent — but it would have failed the META-243 cutover, at exactly the wrong moment. Repointed; it now runs, installs agents-audit@0.4.4 from the registry and verifies the binary.

2. .gitignore was ignoring the wrong directory. It ignored packages/agents-audit/.tmp-*/, but the producer conformance tests that create those directories moved to packages/cli — so their temp dirs were no longer ignored and could have been committed. Generalised to packages/*/.tmp-*/.

3. .github/pull_request_template.md pointed contributors at packages/agents-audit/dist/cli.js. Repointed, and the parity harness added to the checklist for changes to anything agents-audit exposes.

4. Red-test fixture paths in check-architecture.test.mjs named a package that no longer exists. Functionally harmless — they write into a scratch copy — but they should read as the current layout.

Two changelog defects

packages/cli declared CHANGELOG.md in its files list but had no such file, so the packed tarball silently shipped without the changelog it claims to include. Added one, stating up front that the package has never been published and must not be documented as installable until META-243.

The root CHANGELOG.md linked to ./packages/agents-audit/CHANGELOG.md — a dead link since META-247 — and had no repository-level entry for the architecture change at all. Both fixed, with entries for META-244, META-247 and the parity gating.

Verification

typecheck 3/3 · build 3/3 · tests 82 (32 + 44 + 6)
architecture guard pass (73 files) · red tests 19/19
release:verify-packs pass
release:verify-published now runs (was throwing)
parity: runtime, pack, shim — all exit 0

Scope

Documentation and path corrections. No package, producer, guard or parity behavior changed; no parity assertion weakened.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[charliecreates]

Reviewed the documentation and path corrections. The updated package paths match the current repository layout, and the release-verification version lookup now targets the published agents-audit compatibility package. No blocking issues found.