feat(audit): persistent audit log of agent-initiated privileged actions

Adds a durable, operator-visible audit trail of privileged operations
hive-c0re performs on behalf of an agent — the ones that cross the
agent/operator trust boundary. First entry: infra-container restarts via
the infra_admin-gated `restart` tool, which until now were recorded only
as a hive-priv journal trace.

Backend:
- new `audit_log` module: sqlite-backed store (audit_log.sqlite, same dir
  as build_logs) with schema (ts/agent/action/target/outcome/detail),
  best-effort `record`, `list_recent` (clamped 500), 90-day `vacuum`, and
  a process-singleton handle mirroring build_logs.
- Coordinator opens + installs the handle; main spawns the hourly vacuum.
- agent_server::handle_restart_infra records every attempt (ok, error, and
  capability-denied) via the global handle — best-effort, never fails the
  underlying action.
- dashboard: `GET /api/audit-log` returns recent entries as JSON.

Scope is deliberately agent-initiated privileged actions only (not every
PrivRequest — token writes + nspawn edits are constant lifecycle noise).
Extensible: future agent-initiated priv ops record via the same handle.

Unit tests cover record/list ordering, the 500 clamp, and retention vacuum.

The dashboard *surface* (an AUDIT view consuming /api/audit-log) is a
frontend follow-up coordinated with iris.

hive-c0re/src/agent_server.rs

@@ -545,8 +545,20 @@ async fn handle_restart_child(coord: &Arc<Coordinator>, agent: &str, name: &str)
 /// capability and routes the systemctl restart through hive-priv (which
 /// re-validates the name root-side). Direct, not approval-gated.
 async fn handle_restart_infra(agent: &str, container: &str) -> AgentResponse {
+    // Record the attempt in the operator-visible privileged-action audit trail.
+    // Best-effort: no-op when the global handle isn't installed (early
+    // startup / tests). `action` is stable so the dashboard can group.
+    let audit = |outcome: crate::audit_log::AuditOutcome, detail: Option<&str>| {
+        if let Some(log) = crate::audit_log::global() {
+            log.record(agent, "restart_infra", container, outcome, detail);
+        }
+    };
     if !crate::capabilities::has_cap(agent, hive_sh4re::Capability::InfraAdmin) {
         tracing::warn!(%agent, %container, "agent: infra restart denied (no infra_admin capability)");
+        audit(
+            crate::audit_log::AuditOutcome::Err,
+            Some("denied: missing infra_admin capability"),
+        );
         return AgentResponse::Err {
             message: format!(
                 "restarting infra container `{container}` requires the `infra_admin` capability"
@@ -555,10 +567,15 @@ async fn handle_restart_infra(agent: &str, container: &str) -> AgentResponse {
     }
     tracing::info!(%agent, %container, "agent: restart infra container");
     match crate::priv_client::restart_infra_container(container).await {
-        Ok(()) => AgentResponse::Ok,
-        Err(e) => AgentResponse::Err {
-            message: format!("{e:#}"),
-        },
+        Ok(()) => {
+            audit(crate::audit_log::AuditOutcome::Ok, None);
+            AgentResponse::Ok
+        }
+        Err(e) => {
+            let msg = format!("{e:#}");
+            audit(crate::audit_log::AuditOutcome::Err, Some(&msg));
+            AgentResponse::Err { message: msg }
+        }
     }
 }