fix: write-ahead audit entry so calls stop when the audit log stops accepting writes (SEC-03)

tests/test_transports_startup.py

@@ -341,8 +341,10 @@ async def test_real_stdio_subprocess_serves_the_catalog(tmp_path: Path) -> None:
     payload = json.loads(result.content[0].text)  # type: ignore[union-attr]
     assert "error" in payload and GITEA_TOKEN not in json.dumps(payload)
     audit = (tmp_path / "state" / "audit.log").read_text(encoding="utf-8").splitlines()
-    assert len(audit) == 1
-    assert GITEA_TOKEN not in audit[0]
+    events = [json.loads(line)["event_type"] for line in audit]
+    # A write-ahead entry, then the one tool_invocation entry with the result.
+    assert events == ["tool_call_started", "tool_invocation"]
+    assert all(GITEA_TOKEN not in line for line in audit)
 
 
 # serve command