Ward follow-ups: Gate 3 coherence review, audit persistence, control-plane wiring

[BunsDev]

Follow-ups deferred from #333 (squash 08a9cc6), which landed the Ward decision engine (Gates 1–2) and the fail-closed Ward::apply boundary with Gate 4 audit records:

• Gate 3 (coherence review) — proposals currently classified NeedsCoherenceReview are held, never applied. Implement the review stage so held proposals can resolve.
• Persist Gate 4 audit records — AuditRecords (before/after SHA-256) are emitted in-memory only; write them to the store.
• API/control-plane wiring — Ward is compiled but not yet reachable; wire it into the daemon's apply path so all familiar-surface writes route through it.

Context: RFC-0001 Familiar Contract; specs/coven-familiar-spec PRODUCT.md. Code: crates/coven-cli/src/ward.rs (22 tests).

[BunsDev]

please review @covencat

[BunsDev]

Decomposed into scoped sub-issues after verifying current main (@f8bcee3):

• Gate 3 coherence review → Ward Gate 3: coherence review design (held proposals can resolve) #415 (design-first: compose with the threads-gate §5 staging that now exists; proposal_approved/rejected audit tags already in the schema).
• Gate 4 audit persistence → Ward Gate 4: persist apply AuditRecords into the ward_audit ledger #414 (apply AuditRecords are response-only today; the append-only ward_audit ledger exists but its event_type CHECK is pinned to coven_threads_core::AuditEventType, so persistence needs an upstream variant + migration first — details in the issue).
• Control-plane wiring → largely landed since this was filed (feat(ward): route protected-surface edits through the coven-threads authority gate (Phase 2) #382 routed all familiar-surface writes through Ward::apply with the threads gate in front; fix: harden Ward staging writes #384/fix(ward): re-verify staging parent and harden apply regression coverage #392 hardened the write path; fix(api): advance threads baselines after approval (threads-eql) #409 advances baselines; feat(api): Cave threads read/decision endpoints (/api/v1/threads/*, threads-v3g) #408 added threads read endpoints). Remaining observability gaps (ward read API/CLI verb/reference docs) → Ward control-plane wiring: close the remaining gaps (status/observability) #416.

Keeping this open as the tracking umbrella until the three sub-issues close.