CI guard: static logEvent call-site scan vs checked-in action-classification manifest (MARS-465 follow-up)

MARS-465 migration 040 landed with default-included classification table + directional anti-join, but the static CI guard that scans logEvent/logging call-site literals against a checked-in manifest (audit-mars-ca's precondition: guard = pre-push commit-time scan, not a live DB query) was never built. Without it the default-included safety net has no hygiene gate: new ops/test-noise actions won't get auto-classified out.