volt: manifest_audit.py graduates into tools/ -- graded on both sweep axes, pinned, in TOOLS.md

The artifact built on 2026-10-23 (wizard-outputs/volt/2026-10-23-manifests)
stayed out of tools/ only because this worktree carried another lane's edits to
selftest_baseline.tsv. tools/ is clean at HEAD, so it graduates.

- tools/manifest_audit.py: byte-identical logic to the artifact (sha256
  7e495ada...), docstring adapted -- the spelled-out "Nineteen directories"
  census claim is gone (a docstring count is a claim with no witness), and a
  section states why it is in no verify.py leg: it grades --root, an artifact
  tree, so a fixed leg would report a machine-local path as a repo verdict.
- selftest_sweep.py: 3 probe rows. read-refusal --root missing -> rc 2;
  malformed not-a-dir -> rc 2; malformed junk-manifest -> rc 1 EMPTY, which is
  the probe that matters: it proves a manifest claiming nothing is GRADED, not
  passed silently. New {junkmanifest} fixture (a root whose files.sha256 parses
  as no entry) + its legend line.
- selftest_baseline.tsv: one added row, manifest_audit.py 17 cells.
- docs/TOOLS.md: re-rendered (21 -> 22 tools; probes 1 / 0 / 2).

Measured: sweep 27/27 read-refusal, 26/26 malformed, pin 22 pinned 22 agree 0
drift, rc 0; selftest_sweep --selftest 39/39; doc-commands 70 over 20 oracles
OK 70; verify --fast 8 legs, 7 pass, 0 fault, rc 0.

docs/TOOLS.md

@@ -7,7 +7,7 @@ disagree). Every cell below is derived, never typed -- purpose from the
 module docstring, flags from the tool's own `--help`, probe rows from
 `selftest_sweep.py`'s tables, the gate leg from `verify.py`'s `LEGS`.
 
-**21 tools, 21 with a `--help` oracle.** Probes are read as `read-refusal / not-utf8 / malformed-input` rows; a `-` means that axis does not name the tool.
+**22 tools, 22 with a `--help` oracle.** Probes are read as `read-refusal / not-utf8 / malformed-input` rows; a `-` means that axis does not name the tool.
 
 | tool | what it grades | flags | probes | gate leg |
 |---|---|---|---|---|
@@ -22,6 +22,7 @@ module docstring, flags from the tool's own `--help`, probe rows from
 | `doc_command_check.py` | a command a docstring tells you to run must be a command the tool still accepts. | `--repo` `--rev` `--tools` `--json` `--fail` `--selftest` | 1 / 0 / 1 | `doc-commands` |
 | `gate_blame.py` | which landing turned a gate leg red? | `--repo` `--leg` `--range` `--ref` `--queue` `--index` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `landing_check.py` | is every file at this revision actually served by the forge? | `--repo` `--rev` `--branch` `--base-url` `--path` `--max-bytes` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
+| `manifest_audit.py` | does an artifact's `files.sha256` still describe the bytes beside it? | `--root` `--baseline` `--strict` `--fail` `--json` `--quiet` `--selftest` | 1 / 0 / 2 | - |
 | `path_claim_check.py` | does every in-namespace path this archive names exist at this revision? | `--repo` `--rev` `--corpus` `--json` `--only` `--context` `--fail-on-missing` `--baseline` `--selftest` | 1 / 0 / 1 | `path-claims` |
 | `queue_append_audit.py` | was the queue's index current IN THE TREE of every commit that touched the queue? | `--repo` `--queue` `--index` `--from` `--to` `--all` `--guard` `--timeout` `--json` `--selftest` | 1 / 0 / 1 | `append-audit` |
 | `queue_claim_check.py` | the claim check for `WORK-QUEUE.md`, shipped with its tests. | `--queue` `--json` `--git` `--validate` `--selftest` `--fail-on-stale` `--explain` `--census` | 1 / 1 / 1 | - |