Function audit 

pub fn audit(config: &BrainConfig) -> Vec<Finding>

Inspect config and produce the security findings, sorted worst-first. Pure — no I/O, no LLM — so it is deterministic and unit-testable.