fix: harden peek's audit checks against false positives and blind spots

[OnePunchMonk]

Summary

• split: fixes the embargo check being a silent no-op on datetime time_col values (it was gated on np.issubdtype(dtype, np.number), which is false for the normal datetime case — every embargo check for a typical time series never fired). Now computed in row-index space, dtype-agnostic.
• causality: guards the flagship check against two sources of false CRITICALs — a feature_fn that changes row count (e.g. dropna()), and a non-deterministic feature_fn (unseeded randomness). Both now surface as a WARNING explaining the contract violation instead of a bogus leak finding.
• target_leak: non-numeric feature columns were silently skipped by the correlation test; now emits a WARNING naming them, so CLEAN doesn't imply "all columns checked" when some weren't.
• report: the CLEAN verdict now lists which checks actually ran, and adds an explicit hint when only the shallow target_leak check fired (the default when running peek audit file.csv with no feature_fn/splits/pipeline) — the case most likely to give a user false confidence.
• cli: adds --json to peek audit, exposing the AuditReport.to_dict() output that already existed but had no CLI path (needed for CI gating).

Why

Found while reviewing peek for gaps: several of these were bugs that would silently produce wrong verdicts (embargo dead code, positional-alignment false positives) rather than missing features, which is worse for a tool whose entire value proposition is being an honest auditor.

Test plan

• Added 7 new tests covering each fix (datetime embargo firing/not-firing, length-changing feature_fn, non-deterministic feature_fn, non-numeric column warning, CLEAN verdict naming checks run)
• Full suite: 87 passed
• Manually re-ran peek demo to confirm output still renders correctly end-to-end

🤖 Generated with Claude Code