feat(audit): skip audit log for excluded health/root paths

健康检查与根路径（/health/live、/health/ready、/api/v1/health、
/、/health/storage）没有用户、没业务动作，每秒被 K8s/LB
探针刷一次只会灌进无意义噪音。命中排除集即跳过审计行；
诊断日志（method/path/status/ms 走 stderr）照常打，对容器
运维排错仍有用。

* settings.audit_excluded_paths: list[str] 默认覆盖 5 条
  基础设施路径，env AUDIT_EXCLUDED_PATHS 用逗号分隔
  （pydantic NoDecode + field_validator 兼容 str/list）
* main.py 模块级 _AUDIT_EXCLUDED = frozenset(...)，
  access_log 的 success/exception 两条审计行各加守卫
  诊断无条件打
* 测试用 _AccessLogReplica 复刻 access_log 契约（不 import
  真实 main.py），新增 4 个 case：排除根路径、排除 /health/live、
  不排除路径照写审计、自定义排除集

顺带 schedule 模块：ExecutionResult 与 context 已迁到
schedule.domain.*（execution.py / orchestrator.py /
scheduler.py / worker.py），调用点跟进；schedule 自身
18 个测试在改前改后均通过。

.env.example

@@ -36,6 +36,11 @@ LOG_LEVEL=INFO
 # container). AUDIT_LOG_RETENTION_DAYS=0 disables cleanup of old files.
 AUDIT_LOG_DIR=
 AUDIT_LOG_RETENTION_DAYS=30
+# Exact paths excluded from the audit line (health/root probes carry no
+# business value but fire every second from K8s/LB). The default already
+# covers /health/live /health/ready /api/v1/health / /health/storage;
+# leave empty to keep the default. Comma-separated, e.g. /health/live,/api/v1/health.
+AUDIT_EXCLUDED_PATHS=
 
 # Object storage. Two modes are supported:
 #   STORAGE_BACKEND=s3    — connects to an S3-compatible service (MinIO,