Workspace token routes write no audit lines #27

Context

Since 0.13.0 (#25) the GitHub Actions OIDC route writes one audit line per decision (lazurio.github_app_broker.audit.v1, Worker log stream): decision, code, purpose, verified caller claims and, for a grant, repository, access, permissions and expiry, never a token.

The Workspace routes write nothing: a grant of POST /v1/token (which repository, which tier, for which Workspace) or a refusal (workspace_unauthorized, team_grant_missing, repository_denied) leaves no record in the broker. An operator who needs to know which Workspace obtained a write token for a repository, or who keeps failing authentication, has only GitHub's own audit log of the App's actions.

Proposal

Reuse the same sink and schema with event: "workspace_token" and event: "workspace_proof": Workspace id, repository id and canonical name, live role and minted tier, code and status. Never the Workspace credential, the token or a header. Keep refusals before authentication free of request content beyond the presented Workspace id. Tests as for the OIDC route: every decision writes exactly one line, no line contains a secret.

Kept out of #25 to keep that change to the CI runner path.