feat(audit): surface subtool audit

[kurtisc]

Linked Issue

Closes #1574

Summary

Records a per-session rollup of tool sandbox command-policy decisions, surfaced in nono audit list, nono audit show --json and nono inspect.

Test Plan

Run steps manually:

S=$(mktemp -d)
mkdir -p "$S/config/nono/profiles" "$S/ws"
printf 'public data\n' > "$S/ws/allowed.txt"
printf 'top secret\n'  > "$S/ws/secret.txt"
cat > "$S/config/nono/profiles/toolsum.json" <<EOF
{
  "meta": { "name": "toolsum" },
  "filesystem": { "allow": ["$S/ws"] },
  "network": { "block": true },
  "command_policies": { "commands": { "cat": {
    "executable": "/bin/cat",
    "from": { "session": {
      "sandbox": { "fs_read": ["$S/ws"] },
      "invocation_policy": {
        "default": "allow",
        "deny": [{ "argv": { "contains": ["secret.txt"] }, "reason": "secrets are not readable" }]
      }
    }}
  }}}
}
EOF

export XDG_CONFIG_HOME="$S/config"
export XDG_STATE_HOME="$HOME/.nono-repro/state"
N=./target/debug/nono

$N run --profile toolsum --no-rollback --workdir "$S/ws" -- \
  sh -c 'cat allowed.txt; cat secret.txt'
$N audit list        # tools: cat (1 allowed, 1 denied)
$N audit list --no-tools    # line suppressed

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+2054
Lines removed	-240
Total changed	2294
Classification	Large (> 300 lines)

Affected crates

• crates/nono (core library) — careful review required. This is the security-critical sandbox primitive. A bug here bypasses OS-level isolation for every downstream user.
• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.
• bindings/c (C FFI) — ABI changes can silently break C callers. Confirm header and symbol compatibility.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[lukehinds]

Solid work @kurtisc , just a couple of bits I noticed, but worth verifying my assumptions are correct - the BufReader switch, you might well have a valid reason for that.

[lukehinds]

Any reason for dropping BufReader and using read_to_string?

The advantage with BufReader, it reads chunks and streams, which has a lower memory footprint, compared to read_to_string which reads the whole file into mem first, then iterates over its lines. I guess on most systems that might be ok, but some audit-events.ndjson may get big over time if not pruned.

[lukehinds]

maybe worth a switcheroo on these;

self.append_event(...)?;
self.command_policy_summary.observe_mediation_active()

If there is any sort of recoverable failure in self.append_event, it stops the in-memory summary being written into session.json during the finalization later on

1. Summary state changes in memory.
2. writes to audit-events.ndjson fails.
3. The session continues and later finalizes successfully.
4. session.json contains a summary claiming an event/state that the audit log does not contain.

This might be not be a valid review though, if self.append_event is solid around safe failing - but even still it might be good from a defensive point of view.