[codex] Add session-correlated audit for embedded runs

[jamiesun]

Summary

Fixes #132.

• add optional session_id / run_id context to audit JSONL events
• wire CLI, REPL, schedule, daemon, and embedded API audit loggers to set session_id
• make scoot.run() use a per-run scratch arena while keeping returned replies valid until stop()
• add an embedded API regression test for multiple runs, correlated audit events, and session JSONL output
• update the English and Chinese session/audit docs with the new audit schema

Root Cause

Audit events were written as a global stream with only seq, ts, kind, and msg, so app-server style consumers could not slice audit history by session. The embedded API also did not attach an audit logger and reused the runtime arena for per-run session, skill, and agent scratch state.

Validation

• zig test src/audit.zig
• zig build test --summary all (517/517 tests passed)
• zig build && ./zig-out/bin/scoot --version
• pre-push local CI passed: zig fmt --check, zig build, zig build test, zig build -Doptimize=ReleaseSafe, CLI smoke