None of which can tell you that the hardware isn’t doing something different, for sure. Code audits don’t mean much if the code you’re given isn’t what you’re running.
Schematics?
Still don’t tell you what is inside of a chip. This is a known big area of concern, and is one of the reasons why the US military requires chips be made domestically for sensitive equipment.