Bound waiver audit history reads

[alxxjohn]

Motivation

• The waiver-audit history loader previously used os.ReadFile and json.Unmarshal with no size cap, which allowed repository-controlled cache files to cause unbounded memory allocation and CI OOMs.
• The project already has a shared, size-capped cache loader; reuse it to enforce the same 32 MiB cap for waiver audit history reads.

Description

• Replace the uncapped os.ReadFile/json.Unmarshal path in LoadWaiverAuditHistory with the shared cachefile.Load call and import internal/codeguard/cachefile to apply the existing size cap.
• Remove the direct os.ReadFile and inline json.Unmarshal usage from internal/codeguard/runner/support/waiver_audit_history.go.
• Add tests/support/waiver_audit_history_test.go containing TestLoadWaiverAuditHistoryRejectsOversizedFile which writes a file slightly larger than 32 MiB and asserts the loader treats it as a cache miss.

Testing

• Ran go test ./tests/support and go test ./internal/codeguard/runner/... and all tests passed.
• The new TestLoadWaiverAuditHistoryRejectsOversizedFile passed and verifies oversized waiver-audit history files are rejected.
• gofmt was applied to the modified files prior to testing.

---

Codex Task