Fix 10 audit bugs: path prefix matching, verdict parsing, CORS, stale-task detection, phase mapping

Batch 1 (High severity):
- Bug 1: --audit cat3 now checks .automaton/tasks/ paths
- Bug 4: Verdict PASS/FAIL uses structured ## Status: line parsing
- Bug 5: register-guards.sh checks .json/.jsonc, writes plugin key, strips comments
- Bug 7: --can-edit/--scope-check path prefix uses os.sep boundary

Batch 2 (Medium/Low severity):
- Bug 2: migrate-project.sh find command parentheses for -prune binding
- Bug 3: vram_detect model prefix matching with known-suffix whitelist
- Bug 6: dashboard reads .state file before artifact heuristic fallback
- Bug 8: removed wildcard CORS, added security headers (nosniff, DENY)
- Bug 9: stale-task detection uses .state.lastedit instead of .state mtime
- Bug 10: TEST_PLAN.md maps to test_design (was implement)

249 tests pass (up from 235). All 10 tasks driven through full workflow to completion.

tasks/fix-verdict-pass-inference/BUG_REPORT.md

@@ -0,0 +1,15 @@
+# Bug Report: fix-verdict-pass-inference
+
+## Summary
+The fix replaces substring search with structured-line parsing, correctly matching the dashboard's approach.
+
+## Bugs Found
+
+### Bug 1: Substring match within status line value
+- **Severity**: Low
+- **Location**: scripts/status.py:316
+- **Description**: `_parse_verdict_status_line()` uses `label in after_colon.upper()` which is a substring match within the status value. A status like `## Status: FAILURE` would match `FAIL` (since `"FAIL" in "FAILURE"` is True). However, this is consistent with the dashboard's `parse_verdict_status()` (task.py:82) which has the same pattern, and verdict status values are always exactly "PASS", "FAIL", or "NEEDS_REVIEW" per the referee prompt template.
+- **Suggested Fix**: Use exact match only: `if after_colon.upper() == label`. However, this would diverge from the dashboard's behavior and could break existing verdicts with extra text on the status line.
+
+## Score
++1 (Low)