code-to10 v5 rebase follow-up: keep main #275 resident working on rebased tree

- restore _audit_row in cloud/automations.py as a thin wrapper over
  cloud.auth.audit_on_conn (legacy row + ledger entry pair,
  user_id system, best-effort self-commit preserved). The stack's
  gap-4 option A deleted the direct writer; main #275 resident.py
  imports _audit_row, so the bare rebase broke server import.
  No direct audit_log INSERT is reintroduced, so the #250
  no-bypass scan stays green.
- conformance accounting 238/144 -> 243/149: main #275 added 5
  resident methods that legitimately stay in server.py; moved
  count stays 94, no duplicates.
- directional: resident x3, audit chain, conformance, automations
  x3 suites, 51 tests OK

cloud/automations.py

@@ -610,14 +610,37 @@ def _is_integrity_error(exc):
 
     只有这类错误值得在事务边界重试整段；其它错误重试无用，
     必须立即回滚抛错，不能被重试掩盖成“锁/冲突问题”。
-    旧 _audit_row 已删除：本模块不再有任何 audit_log 直写，
-    审计只走 _audit_on_conn（见模块文档）。
+    本模块不直写 audit_log：审计只走 _audit_on_conn（见模块文档）；
+    下面的 _audit_row 仅为兼容包装（供 main #275 resident.py），
+    本身仍走 _audit_on_conn，不含 audit_log INSERT。
     """
     if isinstance(exc, sqlite3.IntegrityError):
         return True
     return type(exc).__name__ == "PostgresIntegrityError"
 
 
+def _audit_row(conn, project_id, action, detail, now):
+    """兼容包装：供 main #275 resident.py 的审计调用。
+
+    本函数不直写 audit_log（#250 断言只允许 auth.py 出现
+    audit_log INSERT）：经 cloud.auth.audit_on_conn 写
+    audit_log 行 + audit_ledger 链条目同一对，user_id 仍为
+    "system"、created_at 用调用方给的 now。保留 main 旧版的
+    best-effort 自提交语义：写对失败时回滚后吞掉，不影响
+    resident 轮询本身；调用方已 commit 的业务行不受影响
+    （审计对写是独立的后续写）。
+    """
+    try:
+        _audit_on_conn(conn, "system", project_id, action, detail,
+                       created_at=now)
+        conn.commit()
+    except Exception:
+        try:
+            conn.rollback()
+        except Exception:
+            pass
+
+
 def run_due_automation(conn, automation_id, now=None):
     """云端自动化执行器的唯一入口：抢单 -> 配额门 -> 建任务 -> 记产出。