audit: bulk/Core/raw DML writes are never audited #557

Follow-up from #498 (PR #556).

Audit capture runs only on ORM unit-of-work flushes. Three kinds of write skip it with no signal:

• ORM bulk update()/delete() statements, and Core INSERT/UPDATE/DELETE run through session.execute (listeners.py only marks the session as written; writes.py);
• raw text() DML;
• the outbox's own state-change bulk UPDATEs and the task heartbeat UPDATE. These are deliberately excluded bookkeeping, so they only need documenting.

These gaps are listed in docs/modules/audit_log.md.

Options:

• an audited bulk-write helper that records one entry per statement (filter plus values) inside the same transaction;
• a strict mode that refuses unaudited statement DML on models that are audited;
• database-side capture, using triggers, for installs that need full coverage.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4