feat(decompiler): Rec 31 #31-2 — cppRaiiAudit per-file gate for RAII Stage 1

[CryptoJones]

Adds gradle cppRaiiAudit as a new verification task modeled on ignoreAudit / objectInputStreamAudit. The task walks the protected file set and forbids raw new <ClassName>(...) or new <ClassName>[...] allocations — the RAII idiom we want is std::make_unique<T>(...) or std::make_shared<T>(...) (or stack / value allocation), so smart pointers never produce raw pointers to leak across an API boundary.

Stage 1 protected set:

• Ghidra/Features/Decompiler/src/decompile/cpp/address.cc
• Ghidra/Features/Decompiler/src/decompile/cpp/space.cc
• Ghidra/Features/Decompiler/src/decompile/cpp/rangeutil.cc

In-tree state: all three files were already raw-new-free (the audit's mention of range.cc maps to rangeutil.cc in the current tree; the other two never had raw owning allocations). This PR therefore lays the gate to fail CI on any future regression that reintroduces a raw owning pointer in the protected set — it doesn't itself migrate any code.

Wiring:

• gradle/cppRaiiAudit.gradle — new task with PROTECTED_FILES allowlist.
• build.gradle — apply line alongside other audits.
• .github/workflows/build-ghidra.yml — Audit C++ RAII protected files step.

Subsequent stages (#31-3, #31-4, ...) extend PROTECTED_FILES as more files are RAII-converted. The tree-wide "no raw new in cpp/" lint described as #31-10 in RAII_MIGRATION.md is the broader form of this same gate.

Docs updated:

• docs/decompiler/RAII_MIGRATION.md — sequencing table now carries Status column with shipped/open per row.
• SprintPlanning.md — Sprint 6 chore(rec-28): delete DBTraceRegisterContextManagerTest empty-stub — wip sweep #31-2 row marked shipped.

Closes #31-2 of Rec 31.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/