Close workflow audit log writers

[kocaemre]

Summary

• Workflow audit logging can currently leak a file descriptor when Config.LogFile is set because NewWorkflowAuditor opens a log writer but the returned auditor does not retain or expose a way to close it.
• Retain the workflow auditor log writer, add WorkflowAuditor.Close(), and close the optional workflow auditor from coreVMCP.Close() and core construction error paths.
• Share close handling with the HTTP auditor and avoid closing os.Stdout/os.Stderr when audit logging uses default output.

Fixes #6094

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

Manual testing:

• PATH=/usr/local/go/bin:/root/go/bin:$PATH task lint
• PATH=/usr/local/go/bin:/root/go/bin:$PATH go test -race ./pkg/audit ./pkg/vmcp/core
• PATH=/usr/local/go/bin:/root/go/bin:$PATH go test ./pkg/vmcp/composer

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Changes

File	Change
pkg/audit/auditor.go	Reuse a shared close helper and avoid closing stdout/stderr.
pkg/audit/workflow_auditor.go	Retain the log writer and expose Close().
pkg/audit/workflow_auditor_test.go	Cover file-backed close, stdout handling, and close error propagation.
pkg/vmcp/core/core_vmcp.go	Close workflow auditor resources during shutdown and constructor cleanup paths.

Does this introduce a user-facing change?

No. This releases an internal audit log file descriptor when the workflow auditor owner is closed.