Audit decode: surface CBOR AuditEnvelope + EVM calldata decoding to the web UI

[hanwencheng]

Why

The parent-control web UI's step-9 audit view must decode every action and its Heima TX (user flow step 9: "we should be able to decode all the messages"). Today the UI ships a mock decodeCalldata (event-kind → 4-byte selector + function signature) and a deterministic txHash. We need real decoding.

Two halves to decode

1. CBOR AuditEnvelope v1 — agentkeys-core: AuditEnvelope v1 cross-language CBOR vector exporter #137 shipped the cross-language CBOR vector exporter (crates/agentkeys-core/examples/export_audit_vectors.rs) + frozen vectors. We need a decoder path the web UI can call (the audit-service stores envelopes; the UI should render the decoded {op, actor_omni, intent_commitment, ...}).
2. EVM calldata → typed args — decode registerAgentDevice / setScopeWithWebauthn / CredentialAudit.append / appendRoot calldata against the four deployed contract ABIs (AgentKeysScope, SidecarRegistry, K3EpochCounter, CredentialAudit) so the TX panel shows real selectors + decoded params, not a static map.

Proposed shape

• A daemon (ui-bridge) endpoint, e.g. GET /v1/audit/:id/decode → { envelope: {...decoded CBOR...}, tx: { hash, to, selector, fn, args: [...] }, status }.
• Decoder reuses agentkeys-core for the CBOR side (do not re-implement the schema in TS) and an ABI decoder (ethabi / alloy) for the calldata side.
• The web UI's decodeCalldata mock (apps/parent-control) is replaced by a call to this endpoint — already structured as a one-function swap.

Acceptance

• Daemon endpoint returns the decoded CBOR envelope for a real audit row.
• Calldata decoded against the verified ABIs (selector + typed args).
• Web UI step-9 modal renders real decode (replaces the mock).
• Cross-language CBOR vectors from agentkeys-core: AuditEnvelope v1 cross-language CBOR vector exporter #137 used as the decode test fixtures.

Refs

• agentkeys-core: AuditEnvelope v1 cross-language CBOR vector exporter #137 (AuditEnvelope v1 CBOR vector exporter), ci: harden test-broker deploy (idempotent checkout + --locked builds + sccache cross-PR cache) #138 (CI hardening)
• arch.md §11 (tier-1 SSE + tier-2 anchor), §22c (app surface)
• docs/plan/web-flow/issue-9step-flow.md (pushback Stage 8: Production hardening — daemon memory hygiene + CLI defensive features #3), data-model.md (audit stream)