Ward Gate 4: persist apply AuditRecords into the ward_audit ledger

[BunsDev]

Sub-issue of #335 (item 2). Current state (verified on main @f8bcee3):

• Ward::apply emits in-memory AuditRecords (target, resolved, tier, prev/next SHA-256, bytes) for every Tier-2 write; POST /familiars/{id}/edits returns them in the response (ward_change_json) but never persists them.
• The designated single audit store exists: ward_audit (append-only, UPDATE/DELETE-abort triggers), created from coven_threads_core::WARD_AUDIT_SCHEMA_SQL and already used for gate verdicts (validation_verdict) and WARD-C6 compaction_ledger events.

Blocker / design dependency: ward_audit.event_type carries a schema CHECK (event_type IN (...)) enumerating exactly the coven_threads_core::AuditEventType tags (proposal_submitted/approved/rejected/vetoed, ward_updated, validation_verdict, compaction_ledger). Persisting apply records needs:

1. Upstream (OpenCoven/coven-threads): add an AuditEventType::ApplyAudit (or similar) variant + tag to the schema CHECK, plus a documented migration story — SQLite cannot ALTER a CHECK, so existing stores need a guarded table rebuild or a versioned ensure_* migration mirroring the exhaustiveness test at audit.rs:269.
2. Here: after the applied disposition in familiar_edits (api.rs, after advance_applied_protected_baselines), append one row per `report.audit_records()": event_type=apply tag, familiar_id, tier, decision="applied", diff_hash←next_sha256 (prev_sha256 in a JSON detail or dedicated column per upstream design), files_touched=[resolved], channel, submitted_at/decided_at=now. Reuse the insert shape from threads_gate.rs:537.
3. Surface the ledger: read endpoint (e.g. GET /familiars/{id}/audit) + coven read verb via the observe.rs pattern + reference doc.

Acceptance: applied Tier-2 writes appear in ward_audit across daemon restarts; append-only triggers still hold; workspace tests green.

[BunsDev]

Upstream half filed as OpenCoven/coven-threads#5 (new AuditEventType variant + schema CHECK entry + migration story + version bump). This issue consumes that bump once it lands; the downstream persistence point and read surface are specified above.

[BunsDev]

Handoff sent to Cody ⚡ (2026-07-18T21:20Z) for the upstream half (OpenCoven/coven-threads#5) — that's the blocker (ward_audit.event_type CHECK has no tag for applied writes; SQLite can't ALTER a CHECK, so this needs a schema-level version bump + migration).

Order of operations:

1. Cody lands AuditEventType::ApplyAudit + schema tag + WardAuditRecord::for_apply + migration helper in coven-threads, tags v0.1.4.
2. I bump crates/coven-cli/Cargo.toml:29 tag v0.1.3 → v0.1.4.
3. Wire persistence into api.rs::familiar_edits (after advance_applied_protected_baselines, iterate report.audit_records(), append rows using the threads_gate.rs:537 insert shape).
4. Add GET /api/v1/familiars/{id}/audit read endpoint (observe.rs pattern) + coven ward audit CLI verb + cli-ward-audit.md + api.md row.
5. Integration test: applied Tier-2 write appears in ward_audit across daemon restarts; append-only triggers still hold.

Nothing to do here until the v0.1.4 tag lands upstream. — Sage 🌿