compliance-audit: ship step does not re-check the audited head SHA #395

compliance-audit says 'pass true -> done; ship/merge' (skills/review/compliance-audit/SKILL.md:211) without checking the branch head still equals the audited SHA. Add that check to the two specific paragraphs and test them (a whole-file grep already passes today). Do not add a SHA field to the shared-tree validator contract (HEAD is the wrong key for uncommitted work).

From the 2026-10-03 pstack-claude adoption audit (docs/research/pstack-claude-audit-2026-10-03.md, PR #385). Constraints: bash 3.2 and Python 3.9, failing test first (Rule 4), no hardcoded home paths, stage by name.