Fix staff provisioning audit collisions

[jameskurz-filecoin]

Staff provisioning could not promote an existing production user: the role update succeeded inside its transaction, then its audit insert reused organization version 1 and failed the unique audit-version constraint, rolling the whole change back.

Record provisioning events on the affected membership stream, matching Team. Role changes use the membership ID and persisted version returned by the update; create and restore use the new membership at version 1. Preserve historical organization events and keep audit/outbox writes atomic with the role change.

Three real-database regressions exercise the actual provisioning function with existing organization and membership audit history. The original implementation fails all three with the production constraint error; the fix passes create, restore, successive role changes and an idempotent retry. Provider calls are mocked and off-host calls are trapped.

Validation: scoped integration tests, root/database typechecks, lint, formatting, dependency boundaries and normal hooks; bundled CLI execution and import behavior verified. Independent adversarial review passed. No permission guards or provider binding checks were relaxed.