[v0.5] audit-atomic: log AI tool calls with atomic write

[lora-sys]

Follow-up from v0.4.1 review.

Problem

logToolCall in packages/core/src/llm/audit.js writes vault files directly. If the process crashes mid-write, the audit log could be corrupted.

Goal

Use the same atomic write pattern as vault.write: temp + rename.

Acceptance Criteria

• Atomic write (temp + rename) used
• Test: simulate crash mid-write, verify file is not corrupted