chore: establish YCode replication baseline and TODO

scripts/rea/expert-package-audit.mjs

@@ -0,0 +1,12 @@
+/** Bounded excerpts from SHA-verified REA exports, never target filesystem. */
+import fs from 'node:fs'
+import crypto from 'node:crypto'
+const input = process.argv[2]
+const pattern = process.argv[3] || 'expertScanCustomExperts|expertActivatePlugin|expertInstallFromPath|clearSessionMarker|createdBySession|expert-manager'
+const radius = Number(process.argv[4] || 550)
+const d = JSON.parse(fs.readFileSync(input,'utf8'))
+for (const f of d.normalized_result.files) {
+  if (crypto.createHash('sha256').update(f.text).digest('hex') !== f.sha256) throw new Error('SHA mismatch')
+  const matches = [...f.text.matchAll(new RegExp(pattern,'g'))].map(m=>({offset:m.index,text:f.text.slice(Math.max(0,m.index-radius),m.index+m[0].length+radius)}))
+  if(matches.length) console.log(JSON.stringify({path:f.path,sha256:f.sha256,evidenceId:d.evidence_id,matches:matches.slice(0,32),omitted:Math.max(0,matches.length-32)},null,2))
+}