feat(pep): add structured policy audit logging

[gnanirahulnutakki]

Summary

• add a synchronous, structured slog auditor for sanitized hub PEP decisions
• validate every event immediately before emission and reject nil loggers or malformed metadata
• emit permits at INFO, policy denial and approval-required outcomes at WARN
• prove JSON and text logs include only normalized fields and omit selectors, targets, digests, credentials, and fleet data

Scope

No hub listener, endpoint, telemetry backend, persistence, metric/tracing exporter, source connector, or write path is added. This is local process logging of Sith policy metadata only; it is not the E6 decision ledger.

Validation

• make ci plus explicit e2e/build tail
• make e2e-kind
• make e2e-isolation (forced RLS plus 50,000x fuzz)
• make release-check plus independent distribution/formula verification
• manual red-team review; Dependabot/code-scanning/secret-scanning queues each at 0

Closes #115