feat: add per-sector audit checklists generator

[BLTC-520]

feat: add per-sector audit checklists generator

Summary

Adds vault-admin/crawler/gen_sector_checklists.js, a re-run-safe Node generator
(same conventions as the existing crawler — plain fs/regex, no new deps) that turns
the existing finding taxonomy into per-sector audit checklists.

For every sector it aggregates the vuln/ trigger/ impact/ fix tags across all findings
in that sector, ranks each axis by frequency, and writes checklists/{sector}-checklist.md,
plus a Sector Checklists.md index.

Each checklist contains:

• Top vulnerability classes (tickboxes + counts) — what actually breaks in this sector, most common first
• Common triggers, typical impact, and recommended mitigations
• "Study these findings" — wikilinks to representative findings

Goal: give a junior auditor (or someone bridging from web2 security) a data-driven prior —
open the checklist for a protocol's sector before reading the code.

Stats

• 34 sector checklists generated from 2,383 findings (sectors with <5 findings skipped)

Notes

• Named {sector}-checklist.md to avoid an Obsidian basename collision with
  classifications/sector/{sector}/{sector}.md
• Fully idempotent / re-run safe — regenerating produces byte-identical output
• Documented in README.md and vault-admin/crawler/README.md

Test plan

• node vault-admin/crawler/gen_sector_checklists.js runs clean → "Wrote 34 sector checklists"
• Idempotent: re-run produces identical bytes
• node --check passes
• Maintainer: open checklists/Sector Checklists.md in Obsidian, confirm wikilinks resolve

[forefy]

Validated locally:

• node --check passes (syntax clean)
• Fresh run produces byte-identical output to committed files (diff clean)
• Idempotency confirmed on second run
• All 154 finding wikilinks resolve to real files in findings/
• 2,383 findings processed, 34 checklists written (2 sectors skipped with <5 findings) — matches PR claims

Minor issues noted in review (empty wallet/prediction checklists, non-sorted readdirSync, bump() spread) — none are blockers for merge.

[BLTC-520]

Hey @forefy, thanks for the review and approval! Really appreciate the feedback and the opportunity to contribute. Looking forward to contributing more in the future and helping strengthen the ecosystem. Security mindset is key 🔑 to building a safer DeFi environment.