feat(audit): add pricing signature guards and reporting

Add snapshot, signature, and drift guard support for Vertex AI, Cloudflare Workers AI, and Perplexity API, backed by a queryable audit table and recent-window view.

This commit also wires the audit query layer into daily signal materialization and report generation so structure drift becomes a first-class signal instead of a log-only artifact.

scripts/cloudflare_pricing_signature_guard.go

@@ -0,0 +1,51 @@
+//go:build llm_script
+
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"time"
+)
+
+func main() {
+	loadSubscriptionImportEnv()
+
+	var url string
+	var fixture string
+	var snapshotDir string
+	var baselinePath string
+	var timeoutSeconds int
+	var allowBootstrap bool
+
+	flag.StringVar(&url, "url", defaultCloudflarePricingFetchURL, "Cloudflare Workers AI 官方价格 markdown")
+	flag.StringVar(&fixture, "fixture", "", "Cloudflare Workers AI 价格样例文件")
+	flag.StringVar(&snapshotDir, "snapshot-dir", "", "Cloudflare snapshot 输出目录")
+	flag.StringVar(&baselinePath, "baseline-path", "", "Cloudflare 结构基线签名路径")
+	flag.IntVar(&timeoutSeconds, "timeout", 20, "请求超时（秒）")
+	flag.BoolVar(&allowBootstrap, "allow-bootstrap", true, "当 baseline 缺失时自动初始化")
+	flag.Parse()
+
+	now := time.Now()
+	cfg := cloudflarePricingSignatureGuardConfig{
+		URL:            url,
+		Fixture:        fixture,
+		SnapshotDir:    snapshotDir,
+		BaselinePath:   baselinePath,
+		Timeout:        time.Duration(timeoutSeconds) * time.Second,
+		AllowBootstrap: allowBootstrap,
+	}
+	result, err := runCloudflarePricingSignatureGuard(cfg, now)
+	if auditErr := persistCloudflarePricingSignatureAuditIfConfigured(cfg, result, now, err); auditErr != nil {
+		fmt.Fprintf(os.Stderr, "cloudflare_pricing_signature_guard audit: %v\n", auditErr)
+		if err == nil {
+			err = auditErr
+		}
+	}
+	fmt.Println(formatCloudflarePricingSignatureGuardSummary(result))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "cloudflare_pricing_signature_guard: %v\n", err)
+		os.Exit(1)
+	}
+}