Audit log wiring + IT isolation, CI fixes (trivy, dual-CI badges)