docs: audit seq emit invariant + counter install order (post-#173/#174)

[initializ-mk]

Summary

Sync the canonical audit doc and the comprehensive knowledge skill to reflect PR #173 (fix: stamp seq on `tool_exec` + `session_end`) and PR #174 (fix: install `SequenceCounter` before the auth middleware so `auth_verify` lands `seq=1`) — both merged to `main`.

No code change. Docs-only. TOC anchors unchanged. Broken-link sweep is clean.

Changes

`docs/security/audit-logging.md` — under `### Sequence numbers`

Two new H4 subsections:

• Counter installation order — `installSequenceCounterMiddleware` wraps the auth chain so the counter is on `r.Context()` before `auth.Middleware` runs. The runner's request entry calls `coreruntime.EnsureSequenceCounter` to reuse the wrapper-installed counter (and only allocate fresh on `--no-auth`). Pinned by `TestAuthAudit_SeqStampedWhenCounterInstalled` and `TestEnsureSequenceCounter_ReusesExisting`.
• Emit invariant — per-invocation events MUST emit via `EmitFromContext` (or a typed helper). Plain `Emit` skips the counter and the trace cross-link. Calls out the regression behind fix(audit): stamp seq on tool_exec + session_end events #173 (3 sites: the two `tool_exec` hooks + the outbound-guardrail-failure `session_end`) and Audit emit: stamp seq on auth_verify / auth_fail by installing the sequence counter before the auth middleware #174 (auth callback). A 4-row table names the sites that intentionally remain on plain `Emit` — egress proxy subprocess `CONNECT`, MCP-server startup, scheduler tick, startup banners — and why. Names Lint: AuditLogger.Emit inside per-invocation scope should be EmitFromContext #175 as the planned lint follow-up.

`.claude/skills/forge.md` — three surgical edits

• § 3 path trace — middleware chain now shows `installSequenceCounterMiddleware` outermost; runner request entry uses `EnsureSequenceCounter`.
• § 12.4 FWS-8 — added the Emit invariant paragraph naming the regression pins and the deliberate plain-`Emit` exceptions.
• § 18 FWS-8 row — appended fix(audit): stamp seq on tool_exec + session_end events #173 / Audit emit: stamp seq on auth_verify / auth_fail by installing the sequence counter before the auth middleware #174 follow-up summary + Lint: AuditLogger.Emit inside per-invocation scope should be EmitFromContext #175 tracker.

Test plan

• Confirm the skill file's TOC anchors still resolve (`grep '^## ' .claude/skills/forge.md`).
• Sanity-read the two new H4 subsections in `docs/security/audit-logging.md` render correctly on the docs site.
• Confirm the named regression tests exist on `main`:
  • `TestToolExecAudit_CarriesSequenceFromContext` (`forge-cli/runtime/audit_tool_exec_seq_test.go`)
  • `TestAuthAudit_SeqStampedWhenCounterInstalled`, `TestEnsureSequenceCounter_ReusesExisting` (`forge-cli/runtime/auth_audit_seq_test.go`)

Closes the docs side of #173 and #174. Does NOT close #175 (that's a code follow-up to add the lint).