Module audit 

Capability audit + publish gate for addons (P3, #403 — the gate before paid).

super::trust::assess answers “what does the wiring do?”. This module answers the two questions that gate listing and paid marketplace entries:

1. Capability coherence — does the declared [capabilities] block match what the wiring actually does? An addon that talks HTTP but declares network = none is under-declaring — a red flag, and a lie the sandbox would otherwise have to catch at runtime.
2. Malware heuristics — content scanning of command/args/env-values for the patterns a wiring-shape check misses: pipe-to-shell, base64-decode → exec, persistence writes, embedded encoded blobs. This is the check the ctxpkg trust_report lists as skipped today.

The result is folded into one AuditVerdict plus a AuditReport::paid_eligible flag — the Verified-tier / paid gate: no danger, capabilities declared + coherent, and (for stdio) a pinned binary hash. Pure + deterministic so the CLI preview, the registry validator and a future publish endpoint share one source of truth (#498).

Structs

AuditReport

The full audit of one addon.

Enums

AuditVerdict

Overall publish verdict, ordered Pass < Review < Fail.

Functions

audit

Audit a manifest: compose wiring risk, capability coherence and malware heuristics into one report. Pure + deterministic.