Harden Bazel PGP audit runfiles and cleanup

[Copilot]

Final cosmetic cleanup for the hermetic OpenPGP audit: remove ambiguous runfile resolution and ensure temporary reports are always cleaned up without changing audit behavior or security guarantees.

• Bazel/Starlark
  • Consolidate audit_bzl into a single bzl_library dependency.
  • Remove the unnecessary _main workspace fallback.
• Audit launchers
  • Restrict runfile resolution to $RUNFILES_DIR and launcher-adjacent runfiles.
  • Store reports under one trap-managed temporary directory.
• Live audit
  • Build //pgp/audit:audit and execute its generated launcher directly with explicit runfiles.
• Documentation
  • Clarify key digest action-key behavior, passphrase re-execution semantics, and hermetic jq usage.

bazel build //pgp/audit:audit
RUNFILES_DIR="$(bazel info bazel-bin)/pgp/audit/audit.sh.runfiles" \
  "$(bazel info bazel-bin)/pgp/audit/audit.sh" --aquery-json "$tmp/aquery.json"