Bind sender identities, add operator read surface, real serving layer

AUDIT-WP-0004 T03, T05, T06.

T03 - the receiver accepted whatever tenant and source a caller sent as long
as it held the one shared token, despite WP-0003 recording tenant isolation as
delivered. audit_core.senders binds each credential to the sources and tenants
it may assert, driven by AUDIT_CORE_SENDERS rather than literals. Identities
hold a list of tokens so rotation publishes the replacement alongside the
incumbent and needs no delivery gap. Read is a separate privilege from write,
so a sender credential cannot read the audit trail back.

T05 - lookup by event id, lookup by correlation id, and a dead-letter view.
Rejections are recorded rather than silently dropped. An event rejected for
carrying secret-shaped material has its payload withheld: storing it would
write that material into the audit store, which is what the rejection exists
to prevent. Reason and payload hash are kept so it stays traceable.

Replay is deliberately not built here. Idempotent replay is a property of the
durable store and building it against SQLite would produce a second
implementation to throw away; it lands with the Postgres backend in
AUDIT-WP-0005-T01.

T06 - serving moves to waitress with configurable threads and channel timeout,
installed in the image via the serve extra. Without it the entrypoint falls
back to a threaded wsgiref server with a socket timeout and graceful shutdown
on SIGTERM, and logs a warning so a deployment cannot quietly land on the
fallback. Metric counters deferred to WP-0005-T03 to be designed against the
real scrape path.

Tests 36 -> 46, covering cross-tenant and cross-source refusal, token
rotation, read/write privilege separation, correlation lookup, and payload
withholding on secret rejection.

Remaining in WP-0004: T04 redaction policy, which needs a decision on whether
a secret-shaped field is a rejection or a redaction.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md

@@ -119,7 +119,7 @@ docstring.
 
 ```task
 id: AUDIT-WP-0004-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "c29be4e7-4c2e-47f0-9d37-7d72061274ee"
 ```
@@ -138,6 +138,14 @@ rather than literals.
 Done when a credential scoped to one tenant is refused when it claims
 another, and that refusal is covered by a test.
 
+Done 2026-08-10: `audit_core.senders` binds each credential to the sources and
+tenants it may assert, configured via `AUDIT_CORE_SENDERS` rather than
+literals. Each identity holds a list of tokens, so rotation publishes the
+replacement alongside the incumbent and needs no delivery gap. Authentication
+compares every candidate token regardless of match position. Read is a
+separate privilege from write. The legacy single-token env var still works but
+grants every tenant and says so.
+
 ## T04 - Settle redaction policy
 
 ```task
@@ -168,7 +176,7 @@ consistent between the contract and the implementation.
 
 ```task
 id: AUDIT-WP-0004-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "006bc4ca-de36-4152-afae-0eef2a402e73"
 ```
@@ -188,11 +196,27 @@ must not be able to read the audit trail back.
 Done when an operator can trace one correlation ID through the system and
 replay a specific event without creating a duplicate.
 
+Done 2026-08-10 (replay deferred, see below): `GET /v1/events/{id}`,
+`GET /v1/events?correlation_id=`, and `GET /v1/dead-letters`, all gated on a
+read privilege a sender credential does not hold. Rejections are now recorded
+rather than silently dropped.
+
+One design point worth keeping: an event rejected *for carrying secret-shaped
+material* has its payload withheld from the dead-letter record. Storing it
+would write that material into the audit store, which is what the rejection
+exists to prevent. Reason and payload hash are retained so the event is still
+traceable.
+
+Replay is deliberately not implemented here. Idempotent replay is a property
+of the durable store, and building it against SQLite would produce a second
+implementation to discard — it lands with the Postgres backend in
+AUDIT-WP-0005-T01, where `accept()` already gives it the semantics it needs.
+
 ## T06 - Serving layer and observability
 
 ```task
 id: AUDIT-WP-0004-T06
-status: todo
+status: done
 priority: high
 state_hub_task_id: "348c2f4c-3ab0-46c7-9ddd-b198122f58ed"
 ```
@@ -215,6 +239,17 @@ Done when the receiver serves concurrent senders under a bounded timeout,
 sheds load predictably instead of stalling, and its behaviour is visible from
 outside.
 
+Done 2026-08-10: serving moves to waitress with configurable threads and a
+channel timeout, installed in the image via the `serve` extra. Where waitress
+is absent the entrypoint falls back to a threaded wsgiref server with a socket
+timeout and SIGTERM/SIGINT shutdown — bounded rather than good, and it logs a
+warning so a deployment cannot quietly end up on it. Logging is structured
+JSON to stdout.
+
+Counters are not yet exposed. Deferred to AUDIT-WP-0005-T03 so the metric
+surface is designed against the deployment's scrape path rather than guessed
+at now.
+
 ## T07 - Close the test gaps
 
 ```task