refactor: reduce audited source duplication

docs/SECURITY_AUDIT.md

@@ -163,10 +163,20 @@ important scanner counts in the tracker issue.
 
 The jscpd step is intentionally scoped to application and test source. It
 excludes documentation snippets, package manifests, generated translations,
-public SVG assets, workflow YAML, and declarative backend schema JSON because
-those reports produce metadata or asset repetition rather than actionable source
-duplication. Keep exclusions narrow and create child issues for source-code
-clusters that cross module ownership or make behavior harder to change safely.
+public SVG assets and catalog output, workflow YAML, declarative backend schema
+JSON, the generated migration baseline, and mirrored development migration
+directories because those reports produce metadata or generated-source
+repetition rather than actionable source duplication. Keep exclusions narrow
+and create child issues for source-code clusters that cross module ownership or
+make behavior harder to change safely.
+
+The 2026-08-02 full-workspace baseline covered 64 repositories and reported
+1.82% duplicated lines before those generated-source exclusions. The reviewed
+high-value clusters were catalog acceptance persistence, release publication
+result assembly, and local WebUI JSON mutation wrappers. Similar Dataflow and
+Workflow graph/governance code remains independently owned until its shared
+contract is stable enough for Core; a raw similarity score is not grounds for a
+module-to-module dependency.
 
 ## Image Freshness