ci(smoke): read the audit JSON and refuse stale wheels

[Marc-cn]

Summary

Follow-up to the review on #575, points 1 and 2:

1. JSON instead of grep. The audit runs with --output json. The check fails on any control with error class evaluation, and requires OSPS-QA-05.01 to pass. The old grep matched "not installed", which fix: report the real cause when cel-python or tree-sitter fails to import #582 reworded.
2. Stale wheels. A dist/ holding more than one wheel of a package is refused, naming the files, instead of silently picking the first.

Point 3 (importing every darnit* module in the full install) is not done here.

Checked by hand: with Requires-Dist: packaging removed from the darnit-core wheel's metadata, the minimal run fails with "controls that could not be evaluated: OSPS-QA-05.01, OSPS-QA-05.02". A duplicate darnit_core-0.0.9 wheel is refused. shellcheck is clean.

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed (CI only)
• Ran uv run python scripts/validate_sync.py --verbose and it passes (not run: CI script only)

Testing

• Tests pass locally (not run: no Python code changed; the CI job runs the script)
• Added tests for new functionality (if applicable)
• Linting passes (shellcheck)

AI assistance

• No AI assistance was used
• AI assistance was used

Claude Fable 5.1 wrote the changes and drafted this description. I ran every command and checked the results myself. The commit carries an Assisted-by: Claude:claude-fable-5-1 trailer.

[mlieberman85]

Thanks, this does what #575's review asked. I checked it: blocking packaging fails with QA-05.01/05.02 as described, and the normal run passes. Point 3 (importing every darnit* module) would still be useful for the proposed F4 rule, since gittuf/reproducibility are only imported through registration; a follow-up is fine. Optional: print each broken control's error.cause next to its id so a CI failure explains itself.

Drafted with Claude Code; reviewed and posted by me.