docs: add the Certora audit report

[remedcu]

Adds the final Certora audit report and an index for it.

Context and Motivation

• Certora reviewed the policy engine between 17 and 25 August 2026, starting from bcb5032 and finalising on 405ba1d. The tip after the five audit-response PRs, so the final report reflects the fixes rather than only the reviewed state.
• Five low severity findings, two fixed and three acknowledged. docs: record that DELEGATECALL value is not what policies check #100–docs: record that fallback dispatch bypasses selector policies #104 carry the responses individually.

Decisions and Tradeoffs

• Laid out to match safe-global/safe-modules, which keeps an audit.md index beside the reports and names them audit-report-<auditor>-<audit scope>. More audits are expected, so the index uses ## Audit N sections that later auditors are appended to.
• When a future version of the contracts is reviewed, that repository's convention is a versioned subdirectory — the natural next step rather than something needed now.
• The scope is recorded explicitly: only PolicyEngine.sol, SafePolicyGuard.sol, AccessSelector.sol and SignatureExtension.sol were reviewed. Everything under contracts/policies/ was out of scope, which a reader would otherwise reasonably assume was covered.

Testing

• Documentation only.

[Copilot]

🟢 Approval recommended

It is an additive documentation-only change whose paths, link, dates, and findings summary were all verified as accurate.

Pull request overview

This PR adds the final Certora audit report (PDF) to the repository along with a new audits/audit.md index file that summarizes the audit. It establishes a documentation convention (modeled after safe-global/safe-modules) using ## Audit N sections so future audits can be appended, and explicitly records the audit scope, dates, source commits, and findings summary. This is purely additive documentation with no code changes.

Changes:

• Adds a new audits/audit.md index describing the Certora audit (auditor, dates, in-scope contracts, findings summary, and a link to the report).
• Adds the binary audits/audit-report-certora-policy-engine-core.pdf (the final report).

File summaries

File	Description
audits/audit.md	New audit index summarizing the Certora audit, scope, and findings, with a relative link to the report PDF.
audits/audit-report-certora-policy-engine-core.pdf	The final Certora audit report (binary, not diff-reviewable).

Verification performed:

• The relative link audit-report-certora-policy-engine-core.pdf resolves correctly to the added file in the same directory (a valid 8-page PDF).
• All four in-scope contract paths (contracts/core/PolicyEngine.sol, contracts/SafePolicyGuard.sol, contracts/libraries/AccessSelector.sol, contracts/libraries/SignatureExtension.sol) exist as written.
• Dates (Aug 17–25, 2026) are in the past relative to the current date; heading structure, spelling, and grammar are clean and consistent.
• The findings summary (five low-severity, two fixed, three acknowledged) is consistent with the PR description.

No issues were found, so I have no comments to store.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.