Describe the Widened Runtime-Secrets Check in AUDIT.md and checks.json #3837

Problem

The burndown/3719-bare-secrets change (for #3719) widens what spec/audit.py's secrets.stems check reads and reports. Two statements of that check still describe the narrower version. That change's claim did not include either file, so they were left as they stand.

• AUDIT.md section 7, the runtime-secrets bullet, says spec/audit.py "reports a tracked name that breaks the rule's form" and "reads each file directly in a .secrets/ directory and each .env file elsewhere", then "The rest is judged by hand".
• spec/checks.json, the secrets.stems description, says "Each tracked env and secret file name takes the form the env and secret file rule sets."

After that change, the check also:

• reads each tracked .gitignore, compose file, and editor config file (.vscode/*.json, .devcontainer configs),
• reports a bare secrets/ directory, from a .gitignore line, a repo-relative path one of those files names, or the directory's own tracked .gitignore, .gitkeep, or .example template,
• judges a secret file one of those files names even where the tree does not track it,
• treats a .txt extension on a file in a secrets directory as a break.

Expected

Both statements describe what the check reads and reports, so an auditor reading AUDIT.md knows which parts are mechanical and which are still judged by hand.