repo-sweep hygiene catalog: provenance entry passes args: sweep, fixing before user review

[kyle-sexton]

Problem

skills/repo-sweep/catalogs/hygiene.md (line 91 in playbooks 0.13.0) runs the provenance entry with args: sweep. In provenance:audit, sweep is the fix pipeline under closure accounting (SKILL.md "Action router" and "Sweep"). It applies fixes as part of the same run. That contradicts repo-sweep next.md step 3.3: "The user reviews them for accuracy before anything is fixed."

Evidence

melodic-software/.github#153, provenance step. No edits happened only because no finding was fix-eligible. A finding that was fix-eligible would have been fixed before the user saw it.

Fix

Pass audit (read-only) in the catalog entry. After the user reviews the findings, the step runs provenance:audit fix on the approved findings. If the per-file closure ledger is wanted, add a #### Notes block saying to run fix file by file.