Audit logs

Every NexusGuard evaluation (ALLOW / BLOCK / CLARIFY) is logged with instruction, intent, decision, reason, and timestamp for this demo session.