feat: add optional signed audit history

[zwliJay]

Summary

Closes #9.

SkillHone already keeps active Issue, Run, PR, Wiki, and test records under a Host-owned database lock while DeepSeek Harness repairs a Skill. This change adds an optional tamper-evident mode for users who also want offline record changes to be detectable.

• Keeps standard as the default with no new setup requirement.
• Adds global and per-Skill config set --audit signed policies.
• Signs repository-scoped Issue, PR, Run, Wiki, test, and evaluation state with a Host-only HMAC key.
• Refuses further audit writes when the signed state or seal no longer matches.
• Shows standard, signed, or mixed audit mode in CLI/Web status.
• Reestablishes an explicit trusted baseline when a user disables and later reenables signed mode.

Security boundary

The repair runtime receives an isolated user home and no SKILLHONE_HOME; the signing key remains outside the Skill repository and Harness environment with mode 0600. Signed mode is tamper-evident rather than an OS/root security boundary. A separate OS account or sandbox is still required when the machine owner or a privileged process is in scope.

Validation

• npm test: 31/31 passed.
• Malicious-runner regression: a nested SQLite write was blocked while Harness was active.
• Offline-tamper regression: a direct database edit changed integrity to failed and subsequent writes were rejected.
• Deterministic CLI/Web E2E: Issue -> queued dispatch -> Run -> 1/1 linked test -> open local PR -> Wiki; Web reported signed + verified and one approval required.
• Real DeepSeek Harness E2E with the pinned @deepseek-ai/dsh@0.1.5-rc.2: repair completed, linked test 1/1 passed, two additional contract checks passed, PR remained open, and main remained unchanged.
• Audit key and seal permissions: 0600.
• npm pack --dry-run: passed; no runtime audit key or local state included.
• gitleaks dir: no leaks found.
• gitleaks git origin/main..HEAD: no leaks found.
• git diff --check: passed.

Review checklist

• Optional feature remains disabled by default.
• Existing repair and merge policies are unchanged.
• No push or merge is performed by SkillHone.
• Threat-model limits are documented without overclaiming.
• Branch contains one focused commit over current main.