Make SimpleAudit JSON export engine-authoritative (delegate summary to AuditResults) #63

Context

build_simpleaudit_export() in audits/services.py (used by the REST export endpoint in audits/views.py) hand-mirrors the engine's results document: Studio computes the safety score with its own _SEVERITY_SCORES table and assembles the summary block manually. This is correct today but drifts silently if the engine changes its scoring formula, key names, or adds fields — there is no test that proves the exported document still loads with the engine.

PR #56 (closed as superseded) had the more robust approach: delegate to the engine.

What to do

1. Add engine.build_audit_results_export(payloads, *, timestamp=None) in infra/engine.py (the only file allowed to import the engine). It reconstructs AuditResults([AuditResult(**filtered_fields)...]) from stored per-scenario payloads (dropping Studio-only keys like trace_ids, _language) and returns collection.to_dict().
2. Replace the hand-rolled assembly + _export_score/_SEVERITY_SCORES in build_simpleaudit_export() with a call to that helper, so the summary is computed by the engine itself. Keep Studio's provenance block (studio_provenance).
3. Add a round-trip test: export a run, write the JSON, load it back with AuditResults.load(path), and assert equality against AuditResults(...).to_dict(). This pins the "loads with the engine" guarantee.
4. Decide handling for n_repetitions > 1 runs (PR feat(runs): export a completed run as the engine's results JSON #56 returned 422; main currently exports whatever durable rows exist).

References

• Supersedes the useful half of feat(runs): export a completed run as the engine's results JSON #56
• Engine-delegation implementation to port: avalyset/run-export-simpleaudit-json → infra/engine.py::build_audit_results_export