[WM-IMP-9] No RMF phase transition audit trail — step changes not logged with actor and timestamp

## WM-IMP-9 — RMF Phase Transition Audit Trail Missing

**Category:** Improvement | **Priority:** Medium

### Observation
RMF phase transitions (e.g., Prepare → Categorize, Assess → Authorize) are not logged with the actor identity and timestamp. There is no audit trail of when and by whom each phase was advanced.

### Recommendation
Implement an immutable audit log for RMF phase transitions.

### Acceptance Criteria
- [ ] Every RMF phase transition logged: from-state, to-state, actor (identity), timestamp, notes
- [ ] Audit trail viewable on system detail page
- [ ] Audit log immutable — no delete or edit capability
- [ ] Audit trail included in ATO package export