feat(audit): finalize incomplete stdio requests

[P4ST4S]

Summary

Complete terminal audit finalization for stdio requests that do not receive a normal JSON-RPC response.

Pending operations now leave one terminal audit entry when they expire, the upstream emits malformed output, a pipe fails, the client disconnects, the upstream terminates, or the proxy is cancelled.

Context

Implements the stdio portion of #69.

Stacked on #74 only.

Approach

• assign the expected completion direction to every pending call
• remove expired calls atomically and finalize them as timeout
• finalize pending client calls as malformed_upstream_response when upstream stdout violates the JSON-RPC wire format
• drain and finalize all pending calls on upstream termination or write/read failures
• classify client output/input failures as client_disconnect
• classify proxy shutdown as cancelled
• remove calls from pending state before finalization so late responses cannot create duplicate terminal entries

Message forwarding remains unchanged: malformed or uninspectable messages are still passed through as required by the proxy transparency invariant.

Test plan

• go test -race ./internal/proxy/... ./internal/audit/...
• go test -race ./...
• go build ./...
• go vet ./...

All commands pass.

Tests cover expiry without sleeps, malformed upstream output, late responses, bidirectional pending calls, upstream write failure, and client write failure.

Stability impact

No existing field or error-code semantics change. The additive outcome and audit_operation_id fields introduced by #74 are now populated on stdio failure paths that previously produced no terminal audit entry.

Notes for reviewer

This PR does not close #69 because the HTTP failure paths are isolated in the next PR.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 70.58824% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/proxy/stdio.go	70.58%	14 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!