fix: restore main's spec heading and CLI input guards

[yannickmonney]

What

Current main still has two independent guard failures after the recent merges:

• Domain-spec guard — AUDIT-R7's heading exceeded the one-sentence limit. It is now A key-made entry names the key's maker, its subject the member it acts for (74 characters); the body, example and tests are unchanged.
• CLI cached checks — services/platform/backend/domains/audit_logs/request-actor.ts is imported by code the CLI's cached checks hash, but was missing from tools/cli/turbo.json inputs.

The observation command-suite inventory line is already present on current main and is intentionally not duplicated in this rebased diff.

Verified

• Base main commit 14921c9b2759b4e05225a8b2f515a37a4f49e132; head 03ac1d4b633457f787a08d68134d56b05888680a.
• Exact current diff: services/platform/backend/domains/audit_logs/spec.md and tools/cli/turbo.json only.
• Focused CI workflow tests: 16 passed, 0 failed, 424 assertions on the pre-existing repair; the current-main rebase is conflict-free.
• Oxfmt and whitespace checks pass.

All seven native required contexts and the complete merge-group gate remain mandatory.

[yannickmonney]

Closing as no longer needed: main carries all three of these lines since #4621 landed (it included the same fix so its own checks could pass) — the AUDIT-R7 heading, audit_logs/request-actor.ts among the CLI lint inputs, and observation.test.ts in the CLI phase list. git diff origin/main fix/audit-r7-heading on these files is empty.