Add strict AGT audit entry adapters

[imran-siddique]

What changed

• map Agent Mesh AuditEntry policy events to normalized policy decisions
• map tool/action audit entries to completed action events
• require a caller-computed full action digest instead of misusing arguments_hash
• derive duration only from valid issued/completed timestamps or an explicit duration
• exclude free-form data and resource values
• document consolidated-core import compatibility and legacy limitations

Why

AGT core retains the existing agentmesh import surfaces. Adopters that consume the audit log instead of GovernanceEventSink need a strict conversion path that does not overstate source integrity or action identity.

Validation

• 71 tests and 16 schema subtests pass
• direct compatibility probe passes against the authoritative Agent Mesh AuditEntry model file
• 8 bundled schemas match normative bytes
• all conformance fixtures pass
• source compilation and diff check pass
• sdist and wheel build successfully
• installed-wheel smoke test passes

Probe note

An initial source-tree package import failed before reaching AuditEntry because the monorepo bootstrap could not resolve the sibling hypervisor package; later chained commands masked that failure. The probe was rerun by directly loading the authoritative audit module and passed.

Limits

Agent Mesh audit hash v1.0 excludes later policy, timing, trace, argument-hash, approver, and environment fields, so verify_hash cannot attest those mapped facts. The minimal Agent OS AuditEntry lacks enough stable identity and correlation for automatic mapping.