fix: guard HMAC slice truncation in audit chain verification (fixes #1332) (#1339)

ev.HMAC[:12] panics when HMAC is shorter than 12 bytes.
Add len guards before truncation so the log line never panics —
the mismatch is still reported, just with whatever prefix is available.

Co-authored-by: Molecule AI Infra-SRE <infra-sre@agents.moleculesai.app>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

workspace-server/internal/handlers/audit.go

@@ -283,9 +283,18 @@ func verifyAuditChain(events []auditEventRow) *bool {
 		// Recompute the expected HMAC.
 		expected := computeAuditHMAC(key, ev)
 		if !hmac.Equal([]byte(ev.HMAC), []byte(expected)) {
+			// Truncate for logging only after confirming the slice is safe.
+			storedPrefix := ev.HMAC
+			computedPrefix := expected
+			if len(storedPrefix) > 12 {
+				storedPrefix = storedPrefix[:12]
+			}
+			if len(computedPrefix) > 12 {
+				computedPrefix = computedPrefix[:12]
+			}
 			log.Printf(
 				"audit: HMAC mismatch at event %s (agent=%s): stored=%q computed=%q",
-				ev.ID, ev.AgentID, ev.HMAC[:12], expected[:12],
+				ev.ID, ev.AgentID, storedPrefix, computedPrefix,
 			)
 			f := false
 			return &f