Deterministic branch diff auditor for AI coding agents. Catches exposed secrets, forbidden formatting, and dirty OS files before production.