Wire mechanical merge-gate for CLAUDE.md §8 (independent audit before merge)

Background

CLAUDE.md §8 (PR #146) defines an "Independent Audit Before Merge" workflow with a hard merge gate: every PR must pass a third-party audit-agent review across 6 angles, and HIGH/MEDIUM findings block merge.

Today the gate is honor-system — there is no GitHub branch protection rule, required status check, or merge-bot enforcing it. An author can technically squash-merge past unresolved findings.

Proposal

Wire one of the following so the gate is mechanically enforced, not just documented:

1. Required status check claude-audit — the audit agent posts a check-run with conclusion success only when no HIGH/MEDIUM findings remain (or all are formally justified per §8.b). Branch protection on main requires this check.
2. CODEOWNERS / merge-bot integration — a bot reads PR comments for the audit-agent's "verdict" line; if not APPROVE, blocks merge.

Option 1 is cleaner — single source of truth (the check), no parsing of comments.

Acceptance criteria

• main branch protection requires the claude-audit check
• Audit agent posts the check-run with conclusion based on its own findings
• Bypassing the check requires repo-admin override (logged)

Refs: CLAUDE.md §8 (added in #146), audit pass on AISIX-Cloud#199 that flagged this gap.

Start with CLAUDE.md §8 and PR #146, then inspect the repository’s existing GitHub configuration and merge path. Choose an enforcement mechanism for the claude-audit result, configure main protection, and verify that HIGH/MEDIUM findings block merging while an admin bypass is logged.