feat: optional separate completion auditor before archival

When a completion auditor is configured, a [goal:complete] is verified
before the goal is archived: approval archives as achieved; rejection
restores the goal (pauses it with reason 'audit rejected') instead of
archiving. Enable the built-in child-session auditor with
completionAudit:true, or supply a custom auditor function (takes
precedence). Built-in fails open without the session API; a thrown
custom auditor or ambiguous verdict fails closed. Off by default.

Adds parseAuditVerdict/buildAuditPrompt/createChildSessionAuditor plus
verdict-parsing, orchestration, and child-session-wiring tests. Item 2.2.