…ce + audit batching

Deliverable A — KR-PROMOTE-ROUTER-TUNING (loop 3):
* ``kora_cli/promote/router_tuning/`` — observer reads
  cost_telemetry.snapshot()'s rolling_24h per-route counters;
  proposer surfaces routes whose Haiku→Opus escalation rate
  crosses a tunable threshold for operator-review. v1 ships
  ``tighten_review`` recommendations only — the ``loosen_review``
  signal needs a new audit row for operator /opus overrides that
  doesn't exist yet (documented in observer + proposer).
* Audit seam ``promotion.router_trigger_proposed``.
* Endpoints ``GET /api/promotions/router-tuning/pending`` +
  ``POST .../{id}/approve|reject``.
* Default auto-apply OFF — operator scaffolds trigger-pattern
  changes manually from the proposal rationale.

Deliverable B — KR-PROMOTE-TOOL-TRIMMING (loop 4):
* ``kora_cli/promote/tool_trimming/`` — observer tallies
  ``reasoning.tool_called`` audit rows by (route, tool_name) over
  a 30-day window; proposer identifies tools that any route never
  invoked + proposes adding them to that route's drop-list.
* v1 uses union-across-routes as the "available tools" set
  (cheaper than wiring a per-route registered-tool projection;
  documented as a clean future seam).
* Audit seam ``promotion.tool_trim_proposed``.
* Endpoints ``/api/promotions/tool-trimming/...``.
* Default auto-apply OFF — enforcement of the drop-list is
  deferred to the future KR-PLUGIN-TOOL-DESC-TRIM bucket which
  will wire the ``pre_tool_list_finalized`` hook to honor it.

Deliverable C — KR-PROMOTE-PROBE-FIX-ENVELOPES (loop 5):
* ``kora_cli/promote/probe_fix_envelopes/`` — observer reads
  ``probe.investigation_completed`` rows, skips those that already
  triggered an autofix attempt; clusters by (probe, issue_category);
  proposer emits new envelope-action proposals with conservative
  "operator must review" blast-radius default.
* Audit seam ``promotion.probe_envelope_action_proposed``.
* Endpoints ``/api/promotions/probe-envelopes/...``.
* Auto-apply HARDCODED FALSE (no env to flip) per spec §2
  deliverable C — high-risk; never auto-apply. STOP-ASK §4
  mitigation: approve endpoint transitions status + emits audit
  ONLY; operator manually scaffolds approved envelopes into
  ``probes/fix_envelopes.py``. Proposal payload carries the
  suggested FixEnvelope shape verbatim for mechanical copy-paste.

Shared store helper:
* ``kora_cli/promote/_shared/proposal_store.py`` — generic
  pending/approved/rejected/expired file-backed store factored
  out so the 3 new loops don't each duplicate the phrasebook
  store's per-status-dir layout. Snapshot_expand + phrasebook
  keep their bespoke stores unchanged.

Deliverable D — KR-PROBE-DEBOUNCE consecutive-failure buffering:
* Closes the queued #163 follow-on. New env
  ``KORA_PROBE_DEBOUNCE_CONSECUTIVE_REQUIRED`` (default 2).
* Buffer state (probe, category) → (count, first_seen_at)
  alongside the existing flat-window debounce map. Single wakes
  return buffered_skipped; second wake within the existing
  debounce window dispatches; window-expiry resets count.
* Critical severity + ``KORA_PROBE_DEBOUNCE_BYPASS_CRITICAL=true``
  still bypasses the buffer (same operator opt-in env as the
  flat-window bypass).
* Backward compat: ``required=1`` restores PR #166 behavior.

Deliverable E — KR-CHEAP-AUDIT-BATCHING (R3-4 #9):
* ``emit_audit`` now queues to a module-level batch; background
  daemon thread flushes every ``KORA_AUDIT_FLUSH_INTERVAL_SECONDS``
  (default 5s) and on size hit ``KORA_AUDIT_BATCH_SIZE`` (default
  100), whichever first.
* Per-emit interface UNCHANGED — callers still call ``emit_audit``
  synchronously; queue + flusher are internal.
* atexit handler drains pending events on process shutdown so
  short-lived CLI invocations don't lose audit rows.
* BATCH_SIZE=0 explicit opt-out preserves the legacy per-emit
  write path — used by the test conftest globally so existing
  emit-then-read tests stay sync without per-file fixtures.
* Tests cover: size-trigger, time-trigger (background thread),
  per-path grouping, shutdown-drain, opt-out path.

Tests:
* 32 new tests across the 3 new promote loops + shared store.
* 6 new tests for KR-PROBE-DEBOUNCE consecutive-failure paths.
* 6 new tests for KR-CHEAP-AUDIT-BATCHING.
* ``tests/kora_cli/conftest.py`` adds an autouse fixture that
  defaults to BATCH_SIZE=0 so the existing emit-then-read suites
  (wake_consumer, phrasebook, snapshot_expand, hermes_plugin
  audit) keep sync semantics. Dedicated batching tests opt back
  in via their own fixture.
* 582 pass across snapshot / promote / reasoning / probes /
  audit / hermes plugin suites; remaining failures are missing
  local dev-deps (prompt_toolkit, aiosmtplib, etc.) unrelated
  to this PR.

After this lands: all 5 promotion loops live; KR-CHEAP-AUDIT-
BATCHING completes R3-4 cheap-substrate items; KR-PROBE-DEBOUNCE
upgrade closes the queued #163 follow-on.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>