feat: add audit-verified status updates with override tracking

Status updates (feature/test update and batch-update) now verify the
requested status against Roslyn audit classification. Mismatches
require --override "reason" to force. Overrides are logged to a new
status_overrides table and reviewable via 'override list' command.

tools/NatsNet.PortTracker/Program.cs

@@ -40,6 +40,7 @@ rootCommand.Add(DependencyCommands.Create(dbOption, schemaOption));
 rootCommand.Add(ReportCommands.Create(dbOption, schemaOption));
 rootCommand.Add(PhaseCommands.Create(dbOption, schemaOption));
 rootCommand.Add(AuditCommand.Create(dbOption));
+rootCommand.Add(OverrideCommands.Create(dbOption));
 
 var parseResult = rootCommand.Parse(args);
 return await parseResult.InvokeAsync();