compliance-audit-and-improvement.yml calls the model and ignores AGENTS_PAUSED #1309

Problem

AGENTS_PAUSED=true pauses the agent fleet. "feature-ideation reusable calls the model but ignores AGENTS_PAUSED" (#1295) covers the one reusable workflow in this repository that calls a model. Its scope item 3 asked for a check of the others, and that check found a second ungated model call that is not a reusable:

.github/workflows/compliance-audit-and-improvement.yml, job analyze (if: at line 290, anthropics/claude-code-action at line 319, CLAUDE_CODE_OAUTH_TOKEN at line 321, at b1387cbd). It runs on a schedule (Fridays 12:57 UTC) and on dispatch, in this repository only. During a fleet pause it still calls the model.

The other 13 workflow_call reusables here hold only GitHub tokens or App identities and call no model.

Scope

Gate the model-calling job on vars.AGENTS_PAUSED != 'true' as the first term of its if:, and add a fleet-paused notice job with the same shape as the one in feature-ideation-reusable.yml (values through env:, line breaks flattened, no secret, permissions: {}). Decide whether the audit half of the workflow, which calls no model, should keep running during a pause; it probably should.

Acceptance criteria

1. A test that the model-calling job is skipped when the variable is true (any letter case) and runs when it is unset or false.
2. No change in behaviour when the variable is unset.
3. The deterministic audit steps still run during a pause, or the PR says why not.