#1783 Audit timeline is not populated by swamp CLI commands unless the AI-tool hook fires (manual says recording is automatic)

Summary

explanation/the-audit-system states: "Swamp commands are recorded automatically. Every swamp model method run, swamp workflow run, or swamp data query invocation writes an audit entry … No configuration required." In practice, after ~20 swamp commands run from a plain shell in a freshly initialised repo (swamp repo init --tool claude), .swamp/audit/ is empty and swamp audit --hours 1 prints "No audit data found. Run 'swamp repo init --force' to enable the audit hook." Recording only happens through swamp audit record --from-hook invoked by the agent tool's PostToolUse hook. Cron/CI/swamp serve-initiated and interactive shell invocations are invisible to the timeline.

Steps to reproduce

git init repo && cd repo && swamp repo init --tool claude
swamp model create command/shell t --json
swamp model method run t execute --input 'run=echo hi'
swamp workflow create w --json
swamp audit --hours 1      # → No audit data found…
ls .swamp/audit/           # empty

Expected

Either swamp commands self-record (as documented) or the manual and the swamp audit empty-state message say clearly that only hook-captured commands are recorded, so operators don't rely on the timeline as a command audit for scheduled/CI runs.

Environment

swamp 20260822.011157.0-sha.06b61472, Linux x86_64.