tooling: the dead-ID audit compares positively and is a checked script

improvise-52eq: the AGENTS.md recipe searched `bd show` output for "not
found" and printed "all resolve" when there was none, so a bd that was
missing, failing or never run passed the audit. scripts/bd-audit-ids
keeps the file scan and exclusions, then `comm -23`s the cited ids
against `bd list --all --limit 0 --json`. A dead id is exit 1 and is
named. A bd that does not answer is exit 3, never a pass.

scripts/bd-audit-ids-test.sh has eight cases on a throwaway repo with a
fake bd. The old recipe as a rival fails 7 of the 8. Disabling the
comparison fails the dead-id case, and an empty exclusion list fails the
pass case. CI runs it with the other named suites. The "One environment
note" now reports which forms the guard refused and allowed, as observed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

.github/workflows/ci.yml

@@ -280,8 +280,10 @@ jobs:
       # was blind to inline comments for as long as it existed (improvise-xgra).
       # fmt-workspaces is here because its own failure mode is the bug it
       # exists for: a usage error wearing a formatting failure's exit code.
+      # bd-audit-ids is the dead-ID audit, whose recipe once read a bd that
+      # never ran as a clean audit (improvise-52eq).
       - name: The remaining checkers refuse what they claim to
-        run: ./scripts/checkers.sh pr-watch release-preflight pr-reviews fmt-workspaces
+        run: ./scripts/checkers.sh pr-watch release-preflight pr-reviews fmt-workspaces bd-audit-ids
 
   # ---------------------------------------------------------------------------
   # Lints the one crate the `test` job cannot reach.