feat: add runtime audit adapters

[hlinor-systems]

Summary

• add metadata-only runtime event ingestion and deterministic aggregation
• add OpenTelemetry JSON and API Gateway JSON/JSONL adapters
• add runtime-to-static inventory matching with ACP-R001 through ACP-R004 findings
• add agentctl runtime-audit with source selection, JSON/text output, and CI severity gates

Validation

• go test ./...
• go build ./cmd/agentctl
• CLI smoke test for undeclared target/provider and production write activity

The implementation does not collect prompts, tool arguments, response bodies, authorization headers, or secrets.