#3177 audit verify is hidden by accident: auditCommand.hidden() in mod.ts hides the last subcommand, not audit

Problem

src/cli/mod.ts registers audit with .command('audit', auditCommand.hidden()). Cliffy's hidden() applies to the command a chain last selected. auditCommand is built in src/cli/commands/audit.ts by chaining .command('record', …) through .command('verify', …), so the selected command is verify, and the first call hides audit verify rather than audit.

audit itself ends up hidden only because registerCommands runs twice per process (mod.ts lines 2115 and 2630): the first registration resets the selection to audit, so the second call's hidden() lands on audit.

Observed

• swamp audit --help lists record, alerts, export, log, report and rotate-key but not verify, although swamp audit verify works and nothing marks it as meant to be hidden.
• Hiding audit depends on registration running twice; a single registration would leave it visible.

Expected

audit is hidden explicitly (for example auditCommand.reset().hidden(), or .hidden() where the command is defined before its subcommands are added) and audit verify is visible unless it is meant to be hidden.

Found while implementing swamp-club#3175.