fix(audit): install SequenceCounter before auth so auth_verify lands seq=1 (closes #174)

[initializ-mk]

Summary

Closes #174. The `auth_verify` / `auth_fail` audit events were emitted without a `seq` field because the per-invocation `SequenceCounter` was installed downstream of the auth middleware. Operators saw `auth_verify` sitting outside the per-correlation_id sequence, breaking the FWS-8 gap-detection contract.

Symptom (user-visible, v0.15.0)

```
auth_verify (no seq) ← BUG
session_start seq=1
guardrail_check seq=2
llm_call seq=3
...
```

Fix

Install the `SequenceCounter` on `r.Context()` before the auth chain runs, via a thin middleware wrapper. The auth chain's `OnAuth` callback now uses `EmitFromContext(req.Context(), ...)` and stamps `seq=1` on `auth_verify`. The runner's per-A2A-request setup calls a new `coreruntime.EnsureSequenceCounter` helper that detects the existing counter and reuses it, so `session_start` lands `seq=2` and the per-correlation_id sequence is gap-free.

After

```
auth_verify seq=1 ← FIXED
session_start seq=2
guardrail_check seq=3
llm_call seq=4
...
```

Pieces

File	Change
`forge-core/runtime/audit_schema.go`	New `EnsureSequenceCounter(ctx)` helper — returns ctx unchanged when a counter is present, installs fresh when absent
`forge-cli/runtime/sequence_counter_middleware.go` (new)	Thin wrapper around `auth.Middleware` that installs the counter on `r.Context()` before delegating
`forge-cli/runtime/runner.go`	(1) `AuthMiddleware: installSequenceCounterMiddleware(auth.Middleware(authCfg))` (2) `makeAuthAuditCallback` switches `Emit` → `EmitFromContext(req.Context(), ...)` (3) Three in-request `WithSequenceCounter(ctx, new(...))` calls → `EnsureSequenceCounter(ctx)`
`forge-cli/runtime/auth_audit_seq_test.go` (new)	5 tests pinning the invariant

What stays as plain `Emit` (intentional, documented in PR #173)

Site	Why `Emit` is correct
Egress proxy `OnAttempt` (`source: proxy`)	Subprocess HTTP CONNECT has no Go ctx
`mcp_tool_conflict`	Startup-time, no invocation scope
Schedule dispatcher (`schedule_fire` / `schedule_complete`)	Scheduler tick runs outside any A2A request scope

After this PR, the only "in-scope-but-plain-Emit" pattern that motivated #175 (the lint) is gone. The three remaining sites are genuinely scope-less.

Cost

The wrapper allocates a `SequenceCounter` (~24 bytes) on every HTTP request, including auth-skipped paths (`/.well-known/agent-card.json`, `/healthz`). The counter is unused on those paths but allocation is in the same ballpark as the request struct itself; threading skip-path knowledge into the wrapper would be more complexity than the savings warrant.

End-to-end smoke

`--no-auth` path (wrapper still runs, but auth middleware is a passthrough):

```
session_start seq=1
session_end seq=2
invocation_complete seq=3
```

Auth on (internal-token loopback, like channel-adapter callbacks and CronJob trigger pods):

```
auth_verify seq=1
session_start seq=2
session_end seq=3
invocation_complete seq=4
```

Test plan

• `go test -count=1 ./...` clean in forge-core and forge-cli
• `golangci-lint run ./...` → 0 issues
• `gofmt -w` applied
• 5 new tests pass:
  • `TestAuthAudit_SeqStampedWhenCounterInstalled` — the Audit emit: stamp seq on auth_verify / auth_fail by installing the sequence counter before the auth middleware #174 pin: counter on req.Context() → auth_verify gets seq=1
  • `TestAuthAudit_NoSeqWhenCounterAbsent` — back-compat: no counter on ctx → omitempty drops the field (legacy embedders that wire their own server.Server without the wrapper still work)
  • `TestSequenceCounterMiddleware_InstallsCounterBeforeNext` — the wrapper installs the counter before delegating to next
  • `TestEnsureSequenceCounter_ReusesExisting` — runner must NOT clobber an auth-installed counter (counter-pointer equality + sequence-continuity assertions)
  • `TestEnsureSequenceCounter_InstallsFresh` — --no-auth / direct-test path: install a fresh counter when ctx has none
• End-to-end smoke against `/tmp/forge-fix174` binary verifying both paths produce the expected seq layout
• Existing `TestAuthAudit_*` tests in `auth_audit_test.go` still pass (the back-compat assertion confirms emit shape is unchanged when no counter is installed)

Schema impact

None. The events were already declared to carry `seq` — the field's `omitempty` JSON tag just dropped it when the value was zero. After the fix, consumers see the field they were already expecting on every per-invocation event; legacy consumers that ignored unknown keys see no behavioral change.

Follow-on

When this merges, the third row of the four-row "plain Emit is intentional" table in #175's lint allow-list disappears (auth callback becomes `EmitFromContext`). The three remaining sites — egress proxy `source: proxy`, `mcp_tool_conflict`, scheduler dispatcher — are genuinely scope-less.