refactor(audits): route all report writes to .claude/audits/

Before: SEO.md, GEO.md, HARDEN.md, VALIDATE.md, BUGS-FOUND.md landed
at project root. After: all five go to .claude/audits/. Covers both
dispatcher write paths and the dispatcher bash commands that parse
each report (test -s, grep score, wc) — otherwise the dispatcher
would look for the file at the old location.

- skills/seo,geo,harden,validate,code-clean — write paths + console
  summaries ("Report: .claude/audits/X.md")
- skills/harden,validate — bash parsing commands (test/grep/wc) aligned
- agents/seo-analyzer,validator-analyzer,code-cleaner — agent-side refs
- agents/validator-analyzer frontmatter description updated

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

agents/code-cleaner.md

@@ -141,7 +141,7 @@ Do NOT call the `/refactor` skill — invoke the agent directly.
 
 If cleanup reveals actual bugs (not style issues — real defects):
 
-- Append each bug to `BUGS-FOUND.md` at project root:
+- Append each bug to `.claude/audits/BUGS-FOUND.md` (run `mkdir -p .claude/audits` first):
   ```
   ## [date] Bug found during code-clean
   - **File**: <file:line>
@@ -178,7 +178,7 @@ REFACTORED:
 SKIPPED (user decision):
 - <item> — <reason>
 
-BUGS FOUND: <N> (logged to BUGS-FOUND.md)
+BUGS FOUND: <N> (logged to .claude/audits/BUGS-FOUND.md)
 
 TESTS: passing / no test suite / <failures>
 ```
@@ -192,7 +192,7 @@ TESTS: passing / no test suite / <failures>
 - No "while we're here" scope creep. Only fix approved items.
 - Exported/public API symbols require explicit per-item user confirmation
   before deletion — even if they appear unused.
-- Bugs go to BUGS-FOUND.md, not fixed in this workflow.
+- Bugs go to .claude/audits/BUGS-FOUND.md, not fixed in this workflow.
 - If the codebase has no tests and the changes are non-trivial,
   warn the user about the risk before executing.
 - No plugin check (lightweight skill, not an orchestrator).