feat(jobs): emit job.enqueue + worktree.pruned audit rows

Deferred audit retrofits from Plan #5 self-review:
- WebhookNotifier now records a job.enqueue audit row after each
  successful repo.Enqueue (best-effort: failures are warn-logged, not
  propagated). Added optional audit.Recorder + *slog.Logger params to
  NewWebhookNotifier.
- WorktreePrune.executionPhase now records a worktree.pruned audit row
  after each successful FinishPruneSuccess. Added optional audit.Recorder
  param to NewWorktreePrune.
- app.go wires the existing auditRec into both constructors.
- integration_test.go: drop the _ = auditRec suppression and pass
  auditRec into the webhook notifier so the closed-loop test exercises
  the audit emit path.

internal/app/integration_test.go

@@ -556,7 +556,7 @@ func TestEndToEnd_WebhookClosedLoop(t *testing.T) {
 		Enabled: true,
 		Topics:  []string{"workspace.sync_failed"},
 		Backoff: []time.Duration{50 * time.Millisecond, 200 * time.Millisecond},
-	}, clock.Real())
+	}, clock.Real(), auditRec, log)
 	disp.Register(n)
 
 	// Run a single Worker (no full Module needed for this test).
@@ -569,9 +569,6 @@ func TestEndToEnd_WebhookClosedLoop(t *testing.T) {
 	t.Cleanup(func() { wcancel(); w.Wait() })
 	go w.Run(wctx)
 
-	// Suppress unused-variable vet warning.
-	_ = auditRec
-
 	eventTime := time.Now()
 	require.NoError(t, disp.Dispatch(ctx, notify.Message{
 		ID: uuid.New(), UserID: uuid.New(),