Record why compliant-looking repositories were not compliant

The fleet audit marks a repository as having a complete pipeline when broad stages are present. It does not compare the repository against the template step by step, so a repository can hold a green mark while missing a third of its steps.

Recorded in the audit, along with two related traps: a security-scanning step that fails fleet-wide but is deliberately non-blocking, and the fact that the first pipeline after a change routinely reports failure because an automatic formatting step corrects the files and stops, with the run that follows succeeding.