Remediation reuses a cached audit made under a different trust target #605

Remediation reuses a cached audit (read_full_audit_cache), including the not-applicable claims that audit honored. The cache key doesn't include the trust target the audit ran under. So a remediation run for one target can act on an audit, and the trust decisions in it, made under another.

Found while fixing the remediation trust target (W-07, branch fix-remediation-trust-target): the run itself now takes its target from the caller, but a cached audit can still carry decisions made for a different one.

Fix: include the canonical trust target (or the trust decision) in the cache envelope and key, and treat a mismatch as a miss, the way #549 does for framework and level.

Drafted with Claude Code; reviewed and posted by me.