Add audit/ with 8 named CVE regression checks against doos

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

audit/Makefile

@@ -0,0 +1,30 @@
+# Runs every CVE regression check under audit/ against a doos binary.
+# Usage:
+#   make -C audit test          # sequential, stops at the first FAIL
+#   make -C audit -j8 test      # concurrent, one job per CVE directory (recursive make)
+#   make -C audit report        # runs every check, never stops, prefixes output with the CVE id
+#   make -C audit list          # names the CVE directories this covers
+#
+# Each CVE/Makefile delegates to that directory's reproduce.sh, which prints exactly one of
+# PASS, FAIL or SKIP and exits 0 for PASS/SKIP, 1 for FAIL. "test" is the hard cap: this file
+# does not invent new checks, it only fans out to the fixed, named list below.
+
+DOOS ?= $(abspath ../build/doos)
+CVES := $(sort $(wildcard CVE-*))
+export DOOS
+
+.PHONY: test $(CVES) list report
+
+test: $(CVES)
+	@echo "audit: $(words $(CVES)) CVE checks run against $(DOOS)"
+
+$(CVES):
+	@$(MAKE) -s -C $@ test DOOS=$(DOOS)
+
+list:
+	@for c in $(CVES); do echo $$c; done
+
+report:
+	@status=0; for c in $(CVES); do \
+		$(MAKE) -s -C $$c test DOOS=$(DOOS) 2>&1 | sed "s/^/$$c: /" || status=1; \
+	done; exit $$status