feat(audit): receive confirmed audit notifications atomically

[jscott3201]

Summary

• receive ConfirmedAuditNotification through one explicitly configured Audit Log sink and a fail-closed, provenance-aware authorizer
• merge or create each accepted notification list in wire order as one object-owned durable transaction, with local insertion timestamps and target Current_Value precedence
• silently discard detected pending/completed duplicates through a bounded, exact-byte, process-local tracker; never replay cached responses
• advertise confirmed execution only and keep UnconfirmedAuditNotification, producers/forwarding, Python receiver configuration, durable idempotency, and Audit BIBB claims out of scope

Standard grounding

• ASHRAE 135-2020 §13.20 and Clause 21: strict confirmed request decoding, explicit logger configuration, and payloadless success
• §12.64: complementary source/target matching, merge-or-create behavior, complete-record drop, local insertion time, and 2 × APDU_Timeout matching window
• §5.3.5.3: detected duplicate Confirmed-Requests are discarded rather than answered from a response cache
• §19.6: payload identities remain reported audit content; transport-observed provenance is supplied separately to application authorization

Validation

• cargo test -p bacnet-objects audit --locked — 28 passed
• cargo test -p bacnet-server audit_notification --locked — 9 passed
• cargo test -p bacnet-server audit_notification --all-features --locked — 10 passed, including BACnet/SC builder coverage
• cargo test -p bacnet-server --locked — 663 unit + 3 integration passed
• cargo test --workspace --exclude rusty-bacnet --locked — passed
• cargo clippy --workspace --exclude rusty-bacnet --all-targets --locked — passed with pre-existing warnings only
• cargo check -p rusty-bacnet --tests --locked — passed
• formatting, conformance generation/JSON, file-size, no-secret, and diff-hygiene checks — passed

Compatibility and limits

• the new BACnetObject capability is defaulted; builder methods are additive
• two new public ServerConfig fields affect callers using exhaustive struct literals
• persistence remains synchronous under the database writer
• duplicate retention is bounded to 256 exact requests for 60 seconds after completion and resets on restart
• a single readable local Device object with a nonzero APDU_Timeout is required
• no UnconfirmedAuditNotification receiver or Audit BIBB claim is added

Refs #345

[jscott3201]

Immutable delivery evidence

• reviewed base: 9107e60c3dd27fd1da0ca77020b87812b9fe56ee
• reviewed head: d26174b12c0e391c253ad97341bb284ed510dc9b
• holistic review cycle 1: PASS; no blocker, major, minor, or nit findings
• dataflow/security review cycle 1: PASS; no blocker, major, minor, or nit findings
• repair cycle: not needed

Local validation at this head:

• Audit object suite: 28 passed
• confirmed receiver suite: 9 passed; all-features/SC coverage: 10 passed
• server package: 663 unit + 3 integration passed
• workspace tests, workspace Clippy, top-crate check, formatting, conformance generation/JSON, file-size, no-secret, and diff hygiene passed

Hosted CI run 33288783597 is green for Rustfmt, Clippy, Ubuntu tests, file-size, and no-secret checks. Conditional release, cross-platform, MSRV, Cargo Audit, and Cargo Deny jobs were skipped by workflow conditions.

The implementation was grounded in ASHRAE 135-2020 §§5.3.5.3, 12.64, 13.20, and 19.6 plus the Clause 21 productions. Claims remain qualified: confirmed receipt only; one explicit sink; fail-closed application authorization; synchronous durable persistence; process-local duplicate detection; no Unconfirmed receiver, producer/forwarder, durable idempotency, Python receiver builder, or Audit BIBB claim.