[AAASM-2286] ✨ (scenarios/audit-trace): Add audit-trace scenario with Python and Node examples

[Chisanan232]

What changed

Added scenarios/audit-trace/ with a full runnable example demonstrating how Agent Assembly records audit events for every governed tool call. Includes a README, expected output reference, and standalone Python and Node.js agent scripts showing allow, deny, and approval_required decisions — all runnable offline without API keys or a live gateway.

Related ticket

Closes #AAASM-2286

How to verify

# Python
python scenarios/audit-trace/python/agent.py

# Node.js
node scenarios/audit-trace/node/agent.js

Both should print 3 audit records (one per tool call) matching the structure in expected-output.txt.

Checklist

• PR title follows [AAASM-XXXX] <GitEmoji> (<scope>): <summary>
• No secrets, API keys, or .env files committed
• Example sub-projects include their own README.md with prerequisites and run instructions
• SDK/runtime version dependencies are documented or pinned

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[Chisanan232]

Code Review — Claude Code

Scope review result: ✅ Ready to merge

CI status

Check	Result
build	✅ pass
run	✅ pass
SonarCloud	⚠️ fail (quality gate — ignored per project policy)

Coverage against AAASM-2286 / AAASM-2197 AC-1

Requirement	Status
scenarios/audit-trace/README.md — concept, flow, setup/run, troubleshooting	✅ present
expected-output.txt — reference output documented	✅ present
Python agent showing allow, deny, approval_required decisions	✅ all three decision types demonstrated
Node.js agent — equivalent behavior	✅ structurally identical output
Audit records include event_id, timestamp, agent_id, tool, decision, reason, inputs, outputs	✅ all fields present
No secrets / API keys committed	✅ .env.example only; no real credentials
Runnable offline without a live gateway	✅ stdlib only, no pip install required

Observations

• send_email correctly raises approval_required (not just deny), demonstrating three distinct decision paths in one run.
• The Python and Node examples produce structurally identical output, making them easy to compare across language stacks.
• expected-output.txt uses <uuid> and <timestamp> placeholders for variable fields — clean for CI comparison if we ever add exact-match tests.

No issues found. Approved from scope and correctness standpoint.