Dual-write operator audits to audit_chain when it is installed

Problem/Motivation

Operator export, history erasure and hard-bounce recovery already write a local postmark_operator_audit row (action, hashed subject, uid, optional target). Sites that already run audit_chain have no tamper-evident copy of those actions.

Webhook intake is high-frequency and must not be written to the chain.

Proposed resolution

Optional File Gate-style dual-write from the operator audit service:

• Composer suggest for drupal/audit_chain. No hard dependency on Key or Encrypt.
• Inject @?audit_chain.logger. When the service is absent, keep current local-only behaviour.
• Channel postmark_webhooks. Operations match the local action codes: export_requested, erase_history_batch, recover_hard.
• Metadata is the hashed subject, uid and optional target. Never a mailbox, never free text, never secrets.
• Call log(), not logKeyed(). Fail open: a chain write error is logged and does not undo the local row or the operator action.
• Keep postmark_operator_audit as the local store. Retention still does not delete those rows.

Remaining tasks

• Implement the soft adapter and tests.
• Document the optional enable path.

User interface changes

None.

API changes

No change to SuppressionPolicyInterface. The operator audit service remains internal.

Data model changes

None in this module. Chain rows are written only when audit_chain is installed.