Root-layout plugin repos: audits scan shipped plugin code only (DEC-083)

[0XSIKIPON]

What & why

Plugins can now live at the repo root (plugin_dir: .) — the layout the plugin hub needs, because A0
clones the whole repo as the plugin. But the audits then scanned the repo's own tests/ and dev
files and flagged them as plugin problems (false alarms on code that never ships).

Fix: the audits now skip repo scaffolding (tests/, .github/, build output, …) — the same set the
CI zip already excludes — so they check only what actually ships. No-op for repos using the old
nested layout.

SPEC alignment

• No behaviour change, or the change satisfies an existing REQ/DEC
• SPEC.md amended in this PR — DEC-083

Checklist

• pytest green locally
• Red-first evidence — before the fix, a root-layout repo fails exactly the 3 shape tests; after, 15/15
• CHANGELOG.md entry — v2.2.0 — unreleased (MINOR)
• Docs — none needed, no interface changed
• sample-plugin-e2e CI gate green