feat: add governed action telemetry

[imran-siddique]

Summary

• add a normalized action.executed contract for tool, MCP, A2A, file, HTTP, and database attempts
• require authorization-subject digests while prohibiting arguments and result payloads
• add bounded action metrics and span/log attributes
• map only action events into TRACE tool transcript hash and call count

Evidence

• full suite: 50 passed, 16 schema subtests passed
• eight bundled schemas match normative bytes
• valid/invalid action conformance vectors pass
• transcript hash changes when action outcome changes
• build and fresh wheel installation pass

Limits

• resolved attempts only; no in-flight lifecycle
• digest correctness and link honesty remain producer responsibilities