fix(drive,docs): guard the audit log's exemption against a resolved OMNI_DEV_LOG_FILE

[newhoggy]

Summary

• omni-dev log prune/OMNI_DEV_LOG_MAX_SIZE rotation now refuse outright when the path they're handed resolves to the audit file — closing the ..-segment/relative/symlink workaround around the --audit flag check.
• record_audit's own collision guard upgraded to the same file-identity comparison.
• Fixes fix(request-log): audit log can be pruned/rotated via OMNI_DEV_LOG_FILE; collision guard is a raw PathBuf compare #1694.

Test plan

• cargo build
• cargo test --lib (9505 passed)
• cargo clippy --all-targets -- -D warnings
• cargo doc --no-deps --document-private-items (the CI Docs job's exact command)
• Reviewed via /code-review high. The original hand-rolled (dev, ino) file-identity check had no real equivalent on non-unix, silently weakening this exact guard on the one non-unix platform this project ships binaries for (Windows) — switched to the same-file crate (already in the dependency graph transitively via walkdir), which does real cross-platform file identity (inode on unix, a file handle on Windows), keeping the hand-rolled symlink-following logic only as a fallback for the not-yet-existing-target case same-file can't handle. Also extracted a magic literal to a named constant and documented the residual TOCTOU window between the check and the destructive read/rewrite (narrows it, does not close it — same shape as an existing inode re-check elsewhere in this codebase).

[github-actions]

Coverage

Total: 97.27% ⚪ 0 pp vs main

Comparing 7312477..f373fb4 (merge-base → PR head)

File	Before	After	Δ
src/request_log.rs	97.85%	98%	🟢 0.14 pp

🔇 5 ignored region(s), 0 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/cli/drive/lease.rs	ignore	408-412	both	a sheet restore's fresh backup is always a DriveCopy — restore.rs's own recheck refuses unless the target is still a spreadsheet, and acquire() only ever takes a Bytes backup of a non-native target; this arm exists solely for exhaustiveness over the shared LeaseBackup enum
src/cli/drive/lease.rs	ignore	928-931	both	guards this test helper against misuse; every call site below passes an acquire subcommand
src/cli/drive/lease.rs	ignore	942-945	both	guards this test helper against misuse; every call site below passes a prune subcommand
src/drive/lease/ledger.rs	ignore	812-816	both	mutate_locked refuses before ever calling the closure, so its body never runs — a hit here is a regression, not a coverage gap
src/drive/lease/restore.rs	ignore	1137-1141	both	every test using this double refuses before authenticating; a hit here is a regression, not a coverage gap

Patch coverage

Patch: 96.39% (187/194 new lines covered)

File	Patch	Uncovered new lines
src/request_log.rs	96.39% (187/194)	484-487, 490-491, 493

Uncovered new lines (7)

• src/request_log.rs:484
• src/request_log.rs:485
• src/request_log.rs:486
• src/request_log.rs:487
• src/request_log.rs:490
• src/request_log.rs:491
• src/request_log.rs:493

Indirect coverage changes

🔴 0 lines lost coverage, 🟢 6 lines gained coverage on unchanged code.

Indirect changes

• src/request_log.rs:545 🟢 uncovered → covered
• src/request_log.rs:546 🟢 uncovered → covered
• src/request_log.rs:547 🟢 uncovered → covered
• src/request_log.rs:599 🟢 uncovered → covered
• src/request_log.rs:600 🟢 uncovered → covered
• src/request_log.rs:601 🟢 uncovered → covered

_{📦 Full per-file coverage summary · run summary}