chore(ci): close cflite checkout gap; delete banned package.json

* Add explicit actions/checkout step to cflite_pr.yml before
  build_fuzzers (resolves AUDIT-2026-05-20-B; fuzzer was failing
  silently on every PR with no source to scan).
* Delete root package.json — typescript devDep + tsc build script
  violate CLAUDE.md language policy (TypeScript banned in favour of
  ReScript; npm banned in favour of Deno). No .ts files remain in
  the repo so it had no live use. Resolves the
  governance / Language anti-pattern policy failure.
* Move AUDIT-2026-05-20-B to Resolved.

https://claude.ai/code/session_01MC3HDKEwGgcRwCuUuRmEeP

Author: claude

.github/workflows/cflite_pr.yml

@@ -14,6 +14,9 @@ jobs:
       matrix:
         sanitizer: [address]
     steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
         uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

AUDIT.adoc

@@ -28,20 +28,19 @@ rather than backward-looking audit events), see
  auto-proof; `No absurd` lacks `Uninhabited` instances).
 |TBD (separate from #27)
 
-|AUDIT-2026-05-20-B
-|2026-05-20
-|Low
-|`.github/workflows/cflite_pr.yml` has no `actions/checkout` step
- before invoking `build_fuzzers`; the fuzzer job has been silently
- failing on every PR.
-|TBD
 |===
 
 == Resolved Audit Items
 
 |===
 |ID |Date resolved |Description |Resolution commit
 
+|AUDIT-2026-05-20-B
+|2026-05-26
+|`.github/workflows/cflite_pr.yml` missing `actions/checkout` before
+ `build_fuzzers`. Added explicit checkout step pinned to v6.0.2 SHA.
+|PR #41 follow-up
+
 |AUDIT-2026-05-20-#27
 |2026-05-25
 |Unsound `alignmentMatchesPlatformWord` postulate (Idris2). The