Audit-snapshot review residuals (peer review of alea#13)

[damienriehl]

Residuals from the multi-agent peer review of alea-institute#13 (merged into feat/translations 2026-08-10). None blocking; KTD1 was explicitly confirmed by Damien.

Bounded race (documented, accepted): the project object loads at request entry, so a trust refusal committed while the PR merge is in flight can still let evaluate_promotion fire. Verified bounded: evaluate_promotion never writes trust_override, and resolve_tier ranks sticky refused/revoked above is_trusted — worst case is one spurious "trust_promoted" notification and a stale is_trusted flag the override outranks. Revisit only if promotion semantics change.

Test hardening:

• Cursor-walk integration test stops before the terminal page: assert second.next_cursor is not None, fetch page 3, assert walk-1 + next_cursor=None (tests/integration/test_outcome_audit.py:519).
• decided_by_name for an ordinary human approve is set but never asserted (suggestion_service.py:1282; add to AE2/AE6/AE7).
• _decode_outcome_cursor binascii.Error / UnicodeDecodeError branches untested.
• No cross-project cursor-replay test (cursor from project A against project B).
• No live-Postgres index reflection vs the model's declared audit-cursor Index (the KTD2 prior-P0 drift class).

Minor: web client types user_id: string | null vs server non-null str (tighten in ontokit-web).