fix(#10,#11): controlled audit failure + pre-mutation record snapshot

[LalaSkye]

What this PR does

Closes #10 and #11. No other scope changes.

---

Issue #10 — Audit failure on deny path must not escape as unhandled exception

Gap: audit.append could raise inside _finish(), causing an uncontrolled exception to escape instead of returning a GateResult.

Fix: _finish() now wraps audit.append in a try/except. If append raises, _finish() returns a controlled GateResult:

• allowed = False
• code = "ERROR:AUDIT_APPEND_FAILED:<ExceptionType>"
• decision_id and timestamp preserved

The caller is never misled: allowed=False means the receipt was not confirmed written.

Tests added:

• test_audit_failure_on_deny_path_returns_controlled_gate_result (deny / no record path)
• test_audit_failure_on_scope_deny_returns_controlled_gate_result (scope mismatch deny path)
• test_audit_failure_on_allow_path_returns_controlled_gate_result (allow path — receipt not written → allowed=False)

---

Issue #11 — Freeze DecisionRecord snapshot before mutation callback

Gap: mutation_callback received the live record mapping and could alter fields that _finish() later logged in record_scope, meaning the audit receipt could reflect post-callback drift rather than the authorised record.

Fix: After all validation passes (structure, signature, timestamps, scope, nonce) but before mutation_callback(record) runs, _snapshot(record) takes an immutable copy of the authorised fields. _finish() now accepts record_snapshot instead of record and uses the snapshot for record_scope. The callback cannot alter what the audit receipt says was authorised.

Tests added:

• test_pre_mutation_snapshot_protects_audit_receipt (callback mutates object_id → receipt still logs authorised value)
• test_pre_mutation_snapshot_is_independent_of_original_dict (callback mutates actor, action, policy → receipt logs pre-mutation values)

---

What was NOT changed

• Issue Bind DecisionRecord proof to exact mutation payload #8 (payload binding) — still open
• Issue Define atomic commit boundary for proof, nonce, mutation, and audit #9 (atomic commit boundary) — still open
• README claim language — unchanged
• Public doctrine — unchanged
• Zenodo paper — not updated

---

Test command

python -m pytest

---

Claim boundary

This PR closes two v1 primitive hardening gaps.

It does not claim production readiness, path-universal coverage, compliance, certification, or adoption.