calm-hub: audit trail is silently dropped in GitHub storage mode

`GitHubAuditLogStore.query()` always returns `List.of()`. Every other storage mode records and queries a real audit trail; GitHub mode has none, silently, with no log line or startup warning.

**Fix**: persist audit events somewhere durable in GitHub mode (a local append log, or push into whichever DB is still configured), or at minimum log a startup warning — same idiom as `OidcRoleResolver`'s global-access-group fallback warning.

(Surfaced during #3066's review.)

Start by locating GitHubAuditLogStore.query() and tracing how other storage modes persist and query audit events. Compare the warning idiom in OidcRoleResolver, then determine which durable persistence option the project supports or whether a startup warning is required. Done means GitHub mode no longer silently drops audit events.

Written by the indexing model from the issue text.