fix: enforce privacy-safe audit event payloads

[kholdrex]

Summary

Audit event payloads are now constrained to an explicit, privacy-safe contract before publication. This prevents raw SQL, prompts, bind values, row data, plans, and unsafe structured values from reaching telemetry subscribers while preserving useful decision metadata.

Changes

• Allowlist audit payload keys and accept only safe scalar values.
• Replace caller-supplied duration values with the measured duration.
• Cover successful events, failure events, SecurityError, unsafe values, and subscriber failures.

Test plan

• 605 RSpec examples pass.
• RuboCop reports no offenses across 60 files.