[GrantFox][High] Add tamper-evident privileged audit records

[greatest0fallt1me]

Summary

Add tamper-evident privileged audit records

Why this matters

Administrative mutations need a reliable history that cannot be silently rewritten.

Scope

Create append-only audit records with actor, tenant, target, outcome, correlation ID, redaction, and integrity chaining.

Acceptance criteria

• Each privileged mutation emits exactly one audit record.
• Application APIs cannot update or delete records.
• Integrity verification detects tampering.
• Tests prove redaction and tenant isolation.

Validation

Add regression coverage for existing behavior, failure modes, authorization boundaries, and compatibility. The implementation must pass the repository CI checks.

Non-goals

• Typo-only, formatting-only, or documentation-only changes.
• Unrelated refactors or dependency upgrades.
• Weakening existing security, authorization, CI, or production safeguards.

Contributor application

Before implementation, comment with relevant experience, a 1–4 bullet approach, and an estimate for opening the first draft PR. Wait for maintainer assignment before coding.

PR requirements

Use a feature branch, include Closes #<issue-number>, check every acceptance criterion, link criteria to code/tests, explain security and failure-mode considerations, and pass CI.

Reward-readiness

This is a substantive GrantFox campaign issue. Merge and CI success do not by themselves guarantee reward eligibility; final reward-readiness is determined by campaign review.