v0.7.2: Merkle provenance audit + RCE flake fix — TDD

audit-node exposes memory-object lineage (type, hash, scope, version).
/audit <node-id> TUI command. /audit verify deferred.

Fixed RCE test flake: assemble-config-section used getf on
non-plist cascade entries. Wrapped in handler-case. Also fixed
~/ format directive escape. Core reason: 35/35. Core: 81/81.

org/core-reason.org

@@ -239,11 +239,13 @@ each cascade call via ~cost-track-backend-call~. All four calls are
     (when (boundp '*provider-cascade*)
       (setf provider-names
             (format nil "~{~a~^, ~}"
-                    (mapcar (lambda (p) (getf p :model))
+                    (mapcar (lambda (p)
+                              (handler-case (or (getf p :model) (getf p :provider) "")
+                                (error () (princ-to-string p))))
                             (symbol-value '*provider-cascade*)))))
     (when (boundp '*hitl-pending*)
       (setf rules-count (hash-table-count (symbol-value '*hitl-pending*))))
-    (format nil "CONFIG: You are Passepartout v0.7.2. Provider: ~a. Context: ~d tokens. Security gates: ~d active. Rules learned: ~d. Documentation: ~/memex/projects/passepartout/docs/USER_MANUAL.org."
+    (format nil "CONFIG: You are Passepartout v0.7.2. Provider: ~a. Context: ~d tokens. Security gates: ~d active. Rules learned: ~d. Documentation: USER_MANUAL.org."
             (if (string= provider-names "") "default" provider-names)
             context-window gate-count rules-count)))