PR 3b — audit binary embedded gojq engine + query subcommand

[jakebromberg]

Follow-up to #191 / #193 (PR 3a). Implements the second half of tracker #177's PR 3 scope: the embedded gojq evaluator and the audit query subcommand.

Scope

• internal/engine/ — gojq wrapper with jq shell-out fallback. Supports the full set of jq flags the existing query corpus uses: -L (library include for _canonical.jq), --arg, --argjson, --slurpfile, -n (null input), -r (raw output), $ENV.NAME reads, and include "_canonical"; resolution against both filesystem-rooted and embed.FS-rooted libraries.
• internal/cli/query.go — audit query <name> handler. Parses the query's front-matter (the parser landed in PR 3a), validates --arg / --argjson against declared arg: lines, wires the seven distinct catalog declarations PR 2's front-matter produces into positional vs --slurpfile shapes, applies --env overlays, and dispatches to the engine.
• cmd/audit/main.go — re-enable the query case (PR 3a stubbed it out).
• cmd/audit/audit_test.go — three integration tests covering the substrate→engine flow: embedded queries are reachable; extract → query → status works end-to-end on a synthetic three-file repo using file-hashes; --catalog <path> overrides work without a populated .audit/.
• go.mod — adds github.com/itchyny/gojq v0.12.19 (the version verified parity-clean in test: verify gojq parity for all 27 queries #188).

Catalog wiring table (per plan PR 3 § "Catalog declarations")

Declaration	Positional input	Slurpfile bindings	Null input?
type-catalog	type-catalog.json	—	no
function-catalog	function-catalog.json	—	no
file-hashes	file-hashes.json	—	no
files	files.json	—	no
type-catalog, references-graph	type-catalog.json	$refs ← references.json	no
function-catalog, type-catalog	function-catalog.json	$types ← type-catalog.json	no
type-catalog, type-catalog	(none)	$left, $right ← user-supplied	yes

The seven cases are exhaustive against PR 2's front-matter declarations; a new combination would require a one-line addition to internal/cli/query.go's slurpfileVar map.

Test plan

• go vet ./... clean
• go test ./... passes (with -race)
• Engine unit tests cover: positional input, --arg, --argjson, --slurpfile, -n, -r, env reads, library-include resolution against both filesystem and embed.FS, system-jq shell-out path
• Integration test exercises extract → query → status end-to-end against the file-hashes extractor
• Smoke test: audit query file-duplicates against a .audit/-cached file-hashes.json returns expected clusters in text and JSONL modes

Dependency

• Depends on PR 3a — audit binary substrate + extract/status subcommands #193 (PR 3a). This PR is opened against feat/pr3a-binary-substrate so reviewers see only the engine + query delta. Once PR 3a — audit binary substrate + extract/status subcommands #193 merges, this PR's base will be retargeted to main.

See plans/pr3-binary-skeleton.md (landed in #193) for the full design rationale.

[jakebromberg]

Implemented in #195 (chained on #193).