feat(audit): persistent audit log of agent-initiated privileged actions

Adds a durable, operator-visible audit trail of privileged operations
hive-c0re performs on behalf of an agent — the ones that cross the
agent/operator trust boundary. First entry: infra-container restarts via
the infra_admin-gated `restart` tool, which until now were recorded only
as a hive-priv journal trace.

Backend:
- new `audit_log` module: sqlite-backed store (audit_log.sqlite, same dir
  as build_logs) with schema (ts/agent/action/target/outcome/detail),
  best-effort `record`, `list_recent` (clamped 500), 90-day `vacuum`, and
  a process-singleton handle mirroring build_logs.
- Coordinator opens + installs the handle; main spawns the hourly vacuum.
- agent_server::handle_restart_infra records every attempt (ok, error, and
  capability-denied) via the global handle — best-effort, never fails the
  underlying action.
- dashboard: `GET /api/audit-log` returns recent entries as JSON.

Scope is deliberately agent-initiated privileged actions only (not every
PrivRequest — token writes + nspawn edits are constant lifecycle noise).
Extensible: future agent-initiated priv ops record via the same handle.

Unit tests cover record/list ordering, the 500 clamp, and retention vacuum.

The dashboard *surface* (an AUDIT view consuming /api/audit-log) is a
frontend follow-up coordinated with iris.

hive-c0re/src/coordinator.rs

@@ -47,6 +47,9 @@ pub struct Coordinator {
     /// `get_full` for the per-card chip + side-panel viewer. See
     /// `build_logs.rs` for retention.
     pub build_logs: Arc<crate::build_logs::BuildLogs>,
+    /// Audit trail of agent-initiated privileged actions (infra restart,
+    /// …). See `audit_log.rs`. Same dir as `build_logs`.
+    pub audit_log: Arc<crate::audit_log::AuditLog>,
     /// URL of the hyperhive flake (no fragment). Inlined into per-agent
     /// `flake.nix` files as `inputs.hyperhive.url`.
     pub hyperhive_flake: String,
@@ -418,6 +421,13 @@ impl Coordinator {
         // to thread an `Arc<BuildLogs>` through every public entry
         // point in the lifecycle surface.
         crate::build_logs::install(build_logs.clone());
+        // Audit log shares the same db dir; install its process-wide
+        // handle so privileged-action recording sites (e.g.
+        // `agent_server::handle_restart_infra`) write without threading an
+        // `Arc<AuditLog>` through the agent-request surface.
+        let audit_log =
+            Arc::new(crate::audit_log::AuditLog::open(build_logs_dir).context("open audit_log")?);
+        crate::audit_log::install(audit_log.clone());
         let (dashboard_events, _) = broadcast::channel(DASHBOARD_CHANNEL);
         let (shutdown_tx, _) = watch::channel(false);
         Ok(Self {
@@ -426,6 +436,7 @@ impl Coordinator {
             questions: Arc::new(questions),
             scheduled_prompts: Arc::new(scheduled_prompts),
             build_logs,
+            audit_log,
             hyperhive_flake,
             nixpkgs_flake,
             nixpkgs_unstable_flake,