Add audit/ with 8 named CVE regression checks against doos

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

COMPARISON.md

@@ -166,7 +166,7 @@ Short answer: it is in the same class as rootless Podman and rootless Docker by
 
 Use doos for your own tools, builds and experiments, where you accept the risk. For code you do not trust, or for several tenants, use rootless Podman with its default seccomp and SELinux or AppArmor, and gVisor or Kata when the kernel must not be shared (see the conclusion table in section 8). Functionally it is also not a drop-in replacement: see section 7.
 
-Full list of what doos does not cover is at the end of [RESEARCH](docs/RESEARCH.md); the exact hardening is in [SPEC](SPEC.md) under Hardening.
+Full list of what doos does not cover is at the end of [RESEARCH](docs/RESEARCH.md); the exact hardening is in [SPEC](SPEC.md) under Hardening. Named CVE regression checks against `build/doos` live in [audit/README.md](audit/README.md) (`make audit`).
 
 ## 7. What doos lacks, and which code would change
 
@@ -183,6 +183,7 @@ These are the gaps that matter when comparing, each next to where it lives. They
 | Linux x86_64 tested only | `src/hardening.cpp` guards aarch64, never run there |
 | seccomp is a denylist | `deniedSyscalls` in `src/hardening.cpp` |
 | Test coverage: one machine | `tests/run.sh` |
+| `fsutil::mkdirs` follows a planted symlink at a container's path, so a symlink at `$DOOS_HOME/containers/<name>` redirects where that container's state is written (low severity on a single-user `$DOOS_HOME`; found by [`audit/CVE-2021-30465`](audit/CVE-2021-30465/README.md)) | `fsutil::mkdirs` in `src/util.cpp` |
 
 ## 8. Conclusion