deepen audit architecture seams

[ncode]

Summary

• Replace Viper-coupled audit server construction with typed runtime settings and normalization seams.
• Split audit server responsibilities across rule-group execution, side-effect processing, and transport adaptation.
• Add typed Vault socket audit device setup helpers and refactor integration tests around reusable listeners/client setup.
• Complete the deepen-audit-architecture-seams OpenSpec change artifacts and tasks.

Impact

This keeps runtime behavior compatible while making the audit server easier to test and reason about at configuration, transport, rule evaluation, and async side-effect boundaries.

Validation

• OpenSpec strict validation for deepen-audit-architecture-seams.
• Go fmt.
• Go vet.
• Race-enabled unit tests across all packages.
• Full coverage run with cover function report.
• Integration compile check.
• Full race-enabled integration suite with AUDIT_HOST=host.docker.internal.
• Auditserver benchmark comparison for React, MatchFrame, and ShouldLog.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.76%. Comparing base (103e53f) to head (038a51d).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #41      +/-   ##
==========================================
+ Coverage   96.22%   96.76%   +0.53%     
==========================================
  Files          10       14       +4     
  Lines         636      803     +167     
==========================================
+ Hits          612      777     +165     
- Misses         19       20       +1     
- Partials        5        6       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.