Audit agentic policy and tool-tier mutations (create/update/delete)

[deepintai]

Context

The agentic PDP records every enforcement decision through the async audit pipeline (AsyncAudit in audit.go), but policy and tool-tiering mutations are not audited. In security-sensitive deployments, operators need a traceable record of who changed a policy or tool tier and when, alongside the decision log.

What to do

1. Add an event-type discriminator to the audit record so non-decision events can be distinguished from decisions — e.g. an EventType field on AuditRecord with values like "decision", "policy_change", "tool_change" (default empty/"decision" to stay backward compatible).
2. In the agentic security handler, emit an audit record on each mutation, capturing the acting user (from session/context), a timestamp, the affected ID, and a short description of the change:
   • createPolicy, updatePolicy, deletePolicy
   • upsertTool, deleteTool
3. Enqueue these records through the same audit sink the decision path uses (AsyncAudit.Enqueue / EnqueueChecked).

Acceptance criteria

• AuditRecord gains an event-type field; existing decision records keep working (no breaking change to readers).
• Each of the five mutation handlers emits an audit record with actor, timestamp, target ID, and change description.
• Unit tests verify a record is enqueued for each mutation using a mock/stub audit writer.
• go test -race ./agentic/... (from deepintshield_server/framework) and the handler tests pass.

File pointers

• Audit pipeline: deepintshield_server/framework/agentic/audit.go (AsyncAudit:67, Enqueue:111, EnqueueChecked:120)
• AuditRecord type: deepintshield_server/framework/agentic/decide.go:74
• Mutation handlers: deepintshield_server/transports/deepintshield-http/handlers/agentic_decide.go (createPolicy:231, updatePolicy:262, deletePolicy:308, upsertTool:339, deleteTool:356)