fix(eventing): make audit mode observable

[mrsabath]

What

Audit mode now logs and counts what enforcement would have rejected.

Fixes #886.

Why

DESIGN_PHASE2.md:359 promises:

Rollout is two flags. A keyset alone verifies and logs while storing events
unchanged; EB_REQUIRE_RESPONSE_SIGNATURE=true is what rewrites them. […] so there
is a step where the reject rate is observable first.

signing.response_decision(event, ks, require=False) returned (True, "<reason>") for
an event that failed verification, and the caller discarded why. Only the if not ok:
branch logged, and audit mode takes the ok=True path — so no log line, no counter, no
reject rate. The documented rollout step could not be performed.

How

response_decision returns (accept, reason, verified).

Audit mode and a clean pass both return accept=True, so distinguishing them meant
matching the reason prose — which exists to be read by a human in a log line, not
parsed.

One subtlety worth a reviewer's eye: the unsigned non-terminal passthrough reports
verified=True, because it is accepted by the signing policy rather than in spite
of a failure. emit() signs terminal events only, so counting those would log every
streamed frame of every genuine run and bury the signal.

Consumer gains audit_failed beside the existing rejected, and one log line per
event:

[kafka_in] audit: would reject response on brave-otter-4718: no ce_signature attribute

The two counters partition the population rather than double-counting it: with
enforcement on, a forgery lands in rejected and audit_failed stays 0. A verifier
that raises while enforcement is off now counts as well — it is still an unverified
acceptance.

Startup already announces the mode (response verification ON (audit only)), so it was
discoverable; it just produced no output afterwards.

Not in scope

No HTTP metrics surface. There is no /metrics, /v0/selftest is a TCP reachability
prober for the public base URL, and the existing rejected counter is a property read
by tests. Wiring a gauge through selftest would be off-topic.

Verification

• tests/test_kafka_in.py + tests/test_keyset.py — 74 passed
• Full eventing/ suite on this base — 902 passed, 7 skipped (4 new tests)
• ruff check clean
• The audit-mode test asserts the row is stored unchanged (phase == "result", no
  signature_rejected), which is the other half of §4.4's promise
• Quiet cases asserted too: a verified response, an unsigned non-terminal frame, and a
  bridge with no keyset configured all leave audit_failed == 0 and log nothing
• Nothing run on a cluster (no cluster access)

[aslom]

Summary

This closes a real gap: response_decision computed a verdict that the caller
structurally could not act on in audit mode, so the two-flag rollout in
DESIGN_PHASE2.md §4.4 was unperformable. Returning verified as a third element
rather than having callers match the reason prose is the right call, and the
accept and not verified partition holds — I checked each branch, and there is no
input where enforcement would reject but audit mode fails to count it, or the
reverse.

I confirmed the counters partition rather than double-count: the only paths that
set verified=False are the final return (not require), why, False and the
except handler, and both yield ok=False under enforcement. The audit log line
mirrors the existing reject line's correlation-id fallback exactly, so operator
output stays consistent.

Two non-blocking notes, both the same root cause — the ks is None branch is the
one place verified=False means "not checked" rather than "a check failed", which
is what obliges the caller to carry a redundant guard — plus one stale row in
DESIGN_PHASE2.md §8.1 that this PR makes untrue.

Author: mrsabath (MEMBER — maintainer)
Areas reviewed: Python (eventbridge consumer, shared signing), tests, design docs
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes
CI status: passing (12/12 — DCO, CodeQL, Trivy, eventing-test, lint, test-startup)

Docs: DESIGN_PHASE2.md §8.1 now contradicts the code

Not inline, because the file is not in the diff.

eventing/agentdocs/DESIGN_PHASE2.md:479 still lists this as a live gap:

| "A keyset alone verifies and logs" | Verifies and returns a verdict. Nothing is logged or counted, so the observable reject rate the two-flag rollout depends on does not exist. | #886 |

That row is exactly what this PR fixes, and the PR body quotes §4.4 as the
justification — so leaving it reading as present-tense fact makes the document
argue against its own implementation. §8's own convention (lines 469–473) is not to
delete the record but to say so explicitly:

where a later phase supersedes an earlier one it says so explicitly rather than
editing in place, and a correction that deletes the original intent loses the more
useful half.

So the fix is to mark the row resolved by this PR, not to drop it.

Second, smaller: the "fifth" gap below that table quotes the call site verbatim as

kafka_in.py has ok, why = True, "not checked" behind if self._keyset is not None

which this PR changes to ok, why, verified = True, "not checked", True. The gap
itself is untouched and out of scope here, but the quotation no longer matches the
file.