[albertovincenzi]

Summary

LogsAudit and AuditOutbox::record() throw a LogicException when a write runs outside an explicit transaction. That keeps the business write and its outbox row atomic, but it blocks adoption in applications that save models outside transactions. cb3-backend is the first case: it will replace its spatie activity log with the Traceflow audit log, and its models are saved from controllers, jobs, imports and webhooks without transactions.

This adds an opt-in policy:

• New setting traceflow.audit.require_transaction (TRACEFLOW_AUDIT_REQUIRE_TRANSACTION), default true: existing installations keep the current behaviour.
• With false:
  • a write outside a transaction stores the outbox row right after the model write. This is the same guarantee as an activity log written from model events: a crash or database error between the two writes loses that event;
  • a write inside a transaction stays atomic (the outbox insert joins it);
  • AuditOutbox::record() follows the same setting.
• AuditOutbox::requireTransaction() keeps always enforcing a transaction, for callers that rely on it. The trait and record() now go through AuditOutbox::guardTransaction().
• README: new "Writes outside transactions" section.
• composer.json version 2.7.2 → 2.8.0. No tag contains the audit API yet (v2.7.2 was created before it, and its split to traceflow-laravel failed in May, so Composer only sees v2.7.1). After merge, tag v2.8.0 so split-laravel publishes it.

Test plan

• vendor/bin/phpunit --testsuite Unit: 155 tests pass (same 8 PHPUnit notices as main)
• New tests: unwrapped create/update/delete/restore are recorded with the setting off; wrapped writes still roll back together; manual record() follows the policy; requireTransaction() still throws. The two behaviour tests fail without the change.
• Default behaviour unchanged: the existing "unwrapped writes are rejected" test still passes
• pint --test on the changed files
• PHPStan level 5: 40 errors before and after, none in src/Audit
• Tag v2.8.0 after merge and check traceflow-laravel gets the tag