fix: create the audit log 0600 in a 0700 directory and refuse symlinks (SEC-11)

docs/audit-logging.md

@@ -63,6 +63,10 @@ keep elsewhere.
 
 The log is written to `AUDIT_LOG_PATH`, default `DATA_DIR/audit.log` (`/var/lib/aegis-mcp` in the
 image). Keep it on durable storage, readable and writable only by the service account.
+The server creates a missing state directory with mode 0700 and the log with mode 0600, tightens
+an older log it owns that is group or world readable, and refuses to open the log through a
+symlink (startup exits with code 2). A keyed (HMAC) chain is not offered: the chain is
+tamper-evident only, so ship the log off the host as the integrity control.
 
 The server opens the file for append at startup and exits with code 2 (message on stderr) when
 that fails, so it never runs unaudited. The check does not stop at startup: each call to a known