* chore(audit): add docs/wire-shape scanner + 2026-05-29 sweep (refs #111)

New offline-rerunnable tool that parses Yandex Direct docs HTML, extracts the
request JSON-schema, and compares with V4_METHOD_CONTRACTS.example_param and
RESOURCE_MAPPING_V5. Closes the methodological gap that allowed the v4
Currency regression (root-caused in #125, fixed by #450) — that PR happened
because verification was done against dg-v4/reference/ pages instead of
dg-v4/live/ ones.

Tooling
-------
- scripts/audit_wire_shape.py — modes: --v4, --v5, --reports, --all.
  Uses a 3-retry × 5-second-pause captcha guard reusing the same markers
  as direct_cli.reports_coverage.fetch_reports_spec. Persistent captcha is
  recorded as `captcha-after-retries` rather than aborting the run.
- tests/test_audit_wire_shape.py — 9 offline golden tests covering
  request-section extraction, schema parsing, response-side leak
  prevention, Live 4 hint detection, example_param key walk, captcha
  marker detection, and v5 per-method URL derivation.

Sweep artefacts (2026-05-29)
----------------------------
- docs/audits/PROJECT_WIRE_SHAPE_AUDIT_2026-05-29.md — 174 findings
  across 32 v4 methods, ~112 v5 operations, 1 reports surface.
- docs/audits/wire_shape.json — same data, machine-readable.

Reproducibility
---------------
    python scripts/audit_wire_shape.py --all \
        --json docs/audits/wire_shape.json \
        --markdown docs/audits/PROJECT_WIRE_SHAPE_AUDIT_2026-05-29.md

Summary writeup with severity-classified findings posted as a comment to
issue #111 (link in the comment body).

This PR adds the auditing capability and the dated report only. Individual
contract / payload-builder fixes for the HIGH-severity gaps (GetEventsLog
contract missing 11 fields, CreateNewForecast missing 3+ fields,
GetBannersTags missing CampaignIDS) are deliberately deferred to follow-up
PRs — one per gap, per the project's "1 issue = 1 PR" rule.

Audit trail: #111 (comment)

Co-Authored-By: Claude Opus 4.7 <[email protected]>

* fix(audit): preserve resource name in v5 per-method URLs + dedup spec URL

Review fixes for #451:

- _v5_per_method_url chopped the trailing path segment unconditionally,
  so single-segment docs bases (vcards, smartadtargets, dynamictextadtargets,
  dynamicfeedadtargets) lost their resource name and resolved to
  `…/ru/get` — silently mis-auditing 4 v5 groups at 404/captcha URLs.
  Now the tail is chopped only when it duplicates its parent segment;
  single-segment bases append the method to the full base.
- The test that locked in the buggy `…/ru/get` output is corrected and a
  vcards regression-guard case is added.
- REPORTS_SPEC_URL now imports REPORTS_SPEC_URLS["spec"] from the registry
  instead of duplicating the literal, per CLAUDE.md "No URL literals
  outside the registry".

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* fix(audit): gate notes-points-at-reference on a verified live page

The FINDING_NOTES_REFERENCE_URL check fired whenever the contract notes
cited dg-v4/reference/ and url_used stayed live_url — but a captcha'd live
page also leaves url_used == live_url, so the finding asserted "live exists,
drop reference" on a page that was never actually read (15/16 v4 methods
were captcha-blocked in the 2026-05-29 run). Require fetched.status == "ok"
so the finding only fires when the live schema was genuinely verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

---------

Co-authored-by: hapi <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
Co-authored-by: axisrow <[email protected]>