Execution audit

Denied execution attempts now have a metadata-only audit boundary.

SCRIMED defines exactly what blocked workflow execution attempts may capture, what must never be captured, and which evidence headers identify the denied event.