Status transitions now audited: PATCH /tools/{id} status moves emit AUDIT

Flipping a tool's status — GOOD → NEEDS_ATTENTION, anything → RETIRED, anything → MISSING — previously wrote silently to the DB with no row in /tools/{id}/events, so asking the events feed "when did this tool retire?" produced nothing. updateTool() now emits an AUDIT ToolEvent with a structured `status_changed: from=X to=Y` description prefix whenever the status enum actually changes. Same `assignment_changed:`-style pattern; no-op on same-value patches; best-effort emission (won't fail the update if the event log write rejects). 6 new contract tests cover GOOD→RETIRED, GOOD→MISSING, BROKEN→GOOD, no-emit on unchanged, no-emit on non-status patches, actorId fallback to null on system paths, and failure recovery.