Audit audience-scoped IFC decisions in buzz-acp

[jmecom]

Adds an audit-only information-flow path to buzz-acp. For each accepted turn, the harness verifies trigger IDs, signatures, and channel binding; resolves relay-signed channel metadata and membership; derives an execution domain; and logs the resulting read, call, publication, and process-reuse decisions.

The default remains off, which constructs no auditor and performs no additional membership queries. audit is observational: denied or unresolved decisions are logged but do not change worker selection, memory loading, tool access, or publication.

This establishes the trusted Buzz facts and policy behavior before any enforcement is introduced. It does not claim OS, credential, filesystem, network, or output confinement.

Testing:

• cargo test -p buzz-acp (820 tests)
• cargo clippy -p buzz-acp --all-targets -- -D warnings

Stack:

1. Audit audience-scoped IFC decisions in buzz-acp #6273: audit-only IFC evaluation
2. Route ACP workers by execution domain #6274: exact-domain ACP worker routing
3. Extract reusable IFC policy and classify worker placement #6275: reusable policy and worker placement
4. Expose IFC policy to external agent harnesses #6176: external harness broker