v0.16.1

Fixed

• CLI commands that read the engine without calling an MCP tool now write an
  audit row, as every MCP call does: they run through the same @governed_tool
  harness, budget and runaway guard included. Before, an operator's CLI reads
  left no trace in audit.db, contrary to the documented guarantee that MCP
  and CLI are audited alike. A test fails if any engine command escapes it.