Function audit 

pub fn audit(events: &[UserActivity]) -> Vec<Finding>

Audit a merged timeline for cross-source user-activity findings.

Emits hedged, low-false-positive observations achievable from the v0.1 sources:

• USERACT-EXEC-DURING-REMOVABLE-MEDIA — a shell command executed within REMOVABLE_MEDIA_WINDOW_SECS of a removable mass-storage device connection (temporal cross-source join). Consistent with activity involving external media (MITRE T1052 / T1091).
• USERACT-HISTORY-TAMPERED — a history-clearing activity present in the timeline (re-surfaced at the user-activity layer; MITRE T1070.003).

Every finding is an observation, never a verdict.