feat(audit): gowdk audit — declarative security posture + baseline policy engine (M8 slice 1)

[cssbruno]

Summary

• Adds the first M8 security audit slice: internal/securitymanifest projects validated IR into a declarative gowdk-security.json posture, and internal/auditspec evaluates the built-in baseline policy set used by gowdk audit.
• Adds gowdk audit with human and --json output, registry-backed experimental audit_* / policy_* diagnostics, source locations, remediation text, and non-zero exits for error findings.
• Extends the baseline to cover action CSRF, command CSRF, guardless action/fragment/command/query endpoints, and public-by-omission APIs.
• Moves build-time gowdk-security.json emission to a non-served sibling report path under .gowdk/reports/<output-name>/, removes stale served copies, and denies/excludes the report from static serving and generated app embedding.
• Updates docs for the CLI, manifest behavior, architecture, roadmap, requirements, diagnostic codes, and the security audit spec.

Issue Closure

Related: #179, #182, #120, #119

Verification

• I ran the relevant tests, lint, and build commands.
• I ran scripts/test-go-modules.sh when Go code or compiler behavior changed.
• I ran go build ./cmd/gowdk when CLI, compiler, runtime, addon, or release behavior changed.
• I ran node --check editors/vscode/extension.js when editor files changed. Editor files were not changed.
• I updated docs for behavior, setup, or architecture changes.
• I added or updated tests for changed behavior.
• I considered security-sensitive surfaces such as auth, CSRF, redirects, request-time handlers, logs, diagnostics, embedded assets, editor commands, WASM, contracts, and realtime behavior.

Commands run:

go build ./cmd/gowdk
go test ./internal/auditspec ./internal/buildgen ./internal/appgen ./runtime/app ./cmd/gowdk ./internal/diagnostics ./internal/securitymanifest
go test ./...
scripts/test-go-modules.sh
go run ./cmd/gowdk audit --json --config gowdk.config.go
go run ./cmd/gowdk audit --json --ssr --config gowdk.config.go
rm -rf /tmp/gowdk-build /tmp/.gowdk/reports/gowdk-build && go run ./cmd/gowdk build --out /tmp/gowdk-build examples/pages/home.page.gwdk examples/pages/hero.cmp.gwdk >/tmp/gowdk-build.out && test -f /tmp/.gowdk/reports/gowdk-build/gowdk-security.json && test ! -f /tmp/gowdk-build/gowdk-security.json
go run ./cmd/gowdk explain audit_command_missing_csrf

Notes:

• gowdk audit --json --config gowdk.config.go fails validation unless --ssr is passed because the repository examples include SSR pages and the default config does not enable the SSR addon.
• gowdk audit --json --ssr --config gowdk.config.go runs and exits non-zero on the existing example CSRF findings, which is the expected CI-gating behavior.

LLM Assistance

• LLM session summary: Implemented the M8 slice, then closed reviewer gaps by adding command/query baseline coverage, moving the build security posture report out of served output, hardening static/generated serving against leaked gowdk-security.json, updating docs/tests, merging current main, and resolving the fixed PR review threads.
• Human-reviewed assumptions: This PR intentionally keeps policy declarations (*.audit.gwdk), frontend audits, emitted tests, and runtime security-header verification deferred to later M8 phases documented in docs/product/security-audit-spec.md.
• Follow-up work: Continue later M8 phases for declared composable policies, frontend audits, runtime/testkit integration, emitted security tests, and security-header verification.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d052ca9565

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".