fix(build): exclude generated reports from formatting

Keep the generated security report and archived audit artifacts outside the maintained Markdown formatter set, and run Tombi offline. This makes the repository formatter deterministic without rewriting generated evidence.

Test Plan:
- just fmt
- just --fmt --check
- git diff --check

justfile

@@ -55,9 +55,9 @@ bundle: catalog-check-production
 
 fmt:
     cargo +nightly fmt
-    tombi format
-    fd -tf -e md -x prettier --write --prose-wrap always --print-width 80
-    rumdl check --flavor commonmark --fix
+    tombi format --offline
+    fd -tf -e md -E security-report -E 'SECURITY_AUDIT_*.md' -x prettier --write --prose-wrap always --print-width 80
+    rumdl check --flavor commonmark --exclude 'security-report/**,SECURITY_AUDIT_*.md' --fix
     just --fmt
 
 _fix: