Add June 18 audit artifacts, bytecode coverage fixes, and shared package pin update

[KillariDev]

Summary

• Adds the full June 18, 2026 Solidity security audit artifact set under audits/, including machine-readable findings JSON, PoC instructions/results, invariant checklist, fuzz/invariant sweep results, remediation verification, and QA report.
• Adds documentation and policy updates in AGENTS.md to clarify immutable imported contract handling and reinforces review workflow expectations.
• Updates Solidity tooling and tests for fork/path accounting and bytecode coverage accuracy, including coverage map separation and trace-to-source tracing improvements.
• Expands peripheral coverage with additional regression checks and simulator adjustments (solidity/ts/tests/erc1155.test.ts, multicall3.test.ts, peripherals.test.ts, AnvilWindowEthereum.ts).
• Updates dependency metadata (package.json and bun.lock) to add a pinned local @zoltar/shared workspace reference.
• Notes that C-01 (truth-auction ETH stranded in forker) is remediated on final head c420a3ac, while C-02 (own-fork excess parent REP stranded in migration proxy) remains open and documented for follow-up.

Testing

• bun run tsc — passed.
• bun run test — passed (1313 pass, 1 skip, 0 fail, 3614 expect calls, 1314 total tests).
• bun run format — passed, no fixes applied.
• bun run check — passed.
• bun run knip — passed.
• bun run test:auction-fuzz — passed (2 pass, 0 fail).
• bun test --timeout 300000 solidity/ts/tests/peripherals.test.ts -t "audit PoC C-0" — passed.
• bun test --timeout 300000 solidity/ts/tests/peripherals.test.ts -t "audit accounting sweep" — passed.