round-12: migrate P8 registries + P12 audit to AppStateStore

- app_state.py: host_state_db_path() (host-level DB, distinct from
  per-VM state_db_path); kv_get/kv_put/kv_delete on meta (namespaced
  keys; kv_put skips the no-secrets guard by design — registry docs
  hold user prompts, documented); audit_trail table (P12 record
  shape + hash chain, seq explicit); counts()/backup() gain
  audit_trail.
- swarm.py / presentation.py / browser_tasks.py: JSON-file backends
  replaced by KV rows (p8-swarm / p8-ledger / p8-browser-tasks);
  legacy JSON imported once on first load (renamed .migrated);
  corrupt row / unreadable store returns empty (fail-safe, same
  semantics as before; next successful save self-heals).
- audit_trail.py: StoreAuditTrail (same record shape, hash chain,
  filters, export as JSONL version, backed by audit_trail table);
  migrate_jsonl_to_store() moves a chain verbatim (broken chain
  refused, divergent seq refused, re-run idempotent). JSONL class
  kept for reading old files.
- P12 dict contracts now run against real P3/P5 code
  (ApprovalQueue.record -> build_approval_card ->
  card_matches_channel; CapabilityIssuer.issue -> describe ->
  PermissionRegistry.record_grant).
- P6->P3 local protocol test: real PrivsepClient + real worker
  server + real git status; worker git argv carries the real P3
  helper + useHttpPath; no token in argv/env/audit. runuser + HTTP
  pull stay real-machine-only (see gap docs).
- Gap docs updated: P8 migration done, guest-side browser follow-up
  explicitly left for the real-machine track (no task_id in the
  browser protocol yet; lifecycle needs a real VM to verify);
  P6 wiring + P12 migration marked done; production-readiness.md
  gains §20 (round-12 integration).
- Tests: new cloud/tests/test_chv_muse_round12.py, 24/24 OK;
  test_chv_muse_p8.py ledger corrupt test rewritten for the KV
  backend (+ legacy-import test). P7+P8: 95+1 tests OK.

docs/chv-muse-p6-gap.md

@@ -129,6 +129,12 @@ Base64、零宽字符）、藏在图片/附件/二进制里的指令、需要理
    authd socket 路径、Sentinel 评估发生在 authd 放凭证前）。本轨
    测试用替身实现同一协议；与 P3 代码的真正接通发生在合入时，
    须由集成轨跑通 worker→helper→authd→git 的全链路。
+   **已接通（round-12，本地部分）**：`cloud/tests/
+   test_chv_muse_round12.py`（WorkerProtocolTest）用真
+   PrivsepClient + 真 worker server + 真 git status 跑通，worker
+   的 git argv 含真实 P3 helper 与 useHttpPath、argv/env/审计
+   均不含 token；runuser 包装与 HTTP 拉取（需真实 gitea.tose.top
+   + Sentinel 放行）留给真机轨。
 2. **worker 跑在客内 root**：worker 守护进程以 root 身份跑在单元外
    （与 P3 authd 同款选择），git 子进程再以 chv 身份跑。root worker
    本身不受单元隔离保护——它的隔离来自 systemd 沙箱 + socket 白名单