feat(FN-4333): emergency hot-fix for post-merge audit blocks

Stop the post-merge audit from parking tasks as `failed` when deterministic
merge verification already proved the merged tree. Adds `postMergeAuditMode`
project setting (`block` | `warn` | `off`, default `block`) and a
verified-tree short-circuit for rebase-strategy overlap-only findings.

- packages/engine/src/merger.ts: new `resolvePostMergeAuditAction` helper
  + audit call site gated on `postMergeAuditMode` and verification-cache
  lookup. Rebase + overlap-only + verified-tree → pass through with a
  short-circuit log entry instead of throwing SquashAuditError.
- packages/core/src/types.ts, settings-schema.ts, index.ts: new
  `PostMergeAuditMode` type, `postMergeAuditMode` field on Settings,
  default `block`, exports `normalizePostMergeAuditMode`.
- packages/engine/src/__tests__/post-merge-audit-action.test.ts: unit
  tests for the decision helper.
- packages/dashboard/app/components/SettingsModal.tsx: settings UI row.
- .changeset: minor bump for @runfusion/fusion.

The FN-3936 silent-drop guard is preserved: duplicate-subject findings
still block in `block` mode and squash-strategy audits still block
(no equivalent deterministic guarantee).

Fusion-Task-Id: FN-4333

packages/core/src/settings-schema.ts

@@ -217,6 +217,7 @@ export const DEFAULT_PROJECT_SETTINGS = {
   mergeDiffVolumeThreshold: undefined,
   mergeDiffVolumeAllowlist: undefined,
   mergeStrategyOverlapBehavior: "flip-to-prefer-branch",
+  postMergeAuditMode: "block",
   workflowStepTimeoutMs: 360_000,
   workflowRevisionForkOnScopeMismatch: true,
   strictScopeEnforcement: false,