tooling: audit-state pause+resume paired, guard advance-while-paused

Audit bug: pause fired turn%12, no resume in same iter. nextTurn then
called on paused encounter → threw 'Encounter not running'. Throw is
correct feature behavior (nextTurn refuses when paused); audit misuse.

Fix: togglePause twice (pause+resume) in one iteration, plus guard
'advance-while-paused' check before nextTurn call.

Result: 6 audit artifacts → 0 violations / 100 rounds.
Confirms BUG-1 resolved as side effect of BUG-2 dup-id fix.

Replay verify: 10 rounds, 103 turns, no skip/dupe.

TODO: BUG-1 + BUG-2 marked RESOLVED/FIXED.

TODO.md

@@ -25,6 +25,9 @@
 ## Confirmed bugs (tests written, NOT fixed)
 
 ### BUG-1: addParticipant + pause/resume corrupts turn rotation
+- **RESOLVED** as side effect of BUG-2 fix (dup-id rejection broke chain).
+- Audit: 0 violations / 100 rounds after BUG-2 fix.
+- Replay: 10 rounds clean, no skip/dupe.
 - Audit: 128 violations / 100 rounds, 4 symptom faces.
 - Symptom chain (one bug family):
   1. pause blocks nextTurn advance → totalTurns stays frozen (e.g. 120)
@@ -43,13 +46,9 @@
 - Real repro = `node scripts/audit-state.js` (or audit-rotation.js).
 
 ### BUG-2: addParticipant allows duplicate id
-- `addParticipant(enc, dup)` appends same id to participants[] twice.
-- togglePause resume rebuilds order → id appears twice in turnOrderIds →
-  nextTurn stuck repeating that id.
-- Reachable in normal app? App uses crypto.randomUUID (fresh ids) so
-  unlikely. But no guard exists — defensive bug.
+- **FIXED** (commit: addParticipant throws on dup id).
 - Test: `shared/tests/turn.characterization.test.js` 'addParticipant rejects
-  duplicate id' — test.skip currently (validates current allow-dup behavior).
+  duplicate id' — GREEN.
 
 ## Pipeline
 - [ ] Red test: dead participant still in turnOrderIds, turn still advances to them