TESS-M1-OBS-001 Scratchpad

Branch: feat/tess-observability-terra (the requested name is checked out by an abandoned worktree; orchestrator approved this clean branch).
Base: origin/main at e92186d7.
Scope: correlation propagation; metadata-only structured runtime/provider/tool audit; health/readiness; safe effective-policy status.
Security invariant: audit and status data use an allowlist; no message bodies, credentials, approval references, tool arguments, or tool output.
TDD: packages/log/src/runtime-audit.test.ts and apps/gateway/src/health/health.controller.test.ts failed before implementation and now pass.
Verification: full pnpm typecheck, pnpm lint, pnpm format:check, and pnpm test passed after implementation (2026-07-12).
Review: corrected audit sanitizer findings by hashing every resource ID. Durable audit persistence remains fail-closed by design: the pre-existing M1 provider-boundary suite requires it to prevent an unaudited side effect.