neatlogs: one session per docs site, and audit traces a judge can read

Every run, bisect, prereqs and audit trace for a docs site shares the session docs:<site> and names the site as its end user, so a session shows everything FirstRun did for one site and evaluations can filter by site. firstrun.audit is now a real root trace whose output carries the summary, the cards and the stale pages, for the new evaluator "audit cards are backed by evidence". evidence/neatlogs.md lists the evaluator and 4 evaluations.