Making the audit a small deliverable of its own is the best idea in here. Quoting a fixed price on an inherited codebase before looking is a bet on the better case, and refusing rescue jobs leaves good clients behind, so a paid first hour or a fixed first milestone is the honest middle.

Block 4 is where I would spend extra care. "70% done" is usually a count of screens, and the works, partial, missing table turns it into something both sides can price. It also gives the client a definition of done for the rest of the project, which the previous developer probably never wrote down. That missing page is often the real reason the first attempt stalled.

Two additions that have helped us: check who owns the hosting, domain and third party accounts during the audit, since rescues often stall on access rather than code, and put the committed secrets finding first in the report even if the job is declined. Do small clients usually accept a paid audit?