More audit cleanups

- Stop doing `build.include? "with-blah"`
- Stop using GitHub archive `.zip` files; prefer `.tar.gz` (as they handle e.g. permissions and generally have better compression)
- Handle whitelisting better in a way that doesn't mess with indentation