feat(audit): add callerName field to AuditToolCallRequest

[gzak]

Summary

• Adds AuditToolCallRequest.callerName (@JsonProperty("caller_name")) alongside the existing toolType field, per getaxonflow/axonflow-enterprise#2912 (sub-issue of epic #2905).
• audit_tool_call's tool_type field was misleadingly named — every real caller (claude_code/codex/cursor/openclaw) used it to identify WHICH CLIENT made the call, not any property of the tool. toolType is now marked @Deprecated (getter, builder method, and the field itself) and kept as an input fallback only — it is NOT removed and NOT renamed. AxonFlow#auditToolCall/auditToolCallAsync needed no changes: they serialize the request POJO via Jackson, so the new field is forwarded automatically.
• The platform side (getaxonflow/axonflow-enterprise#2953) adds the matching caller_name field to the server's AuditToolCallRequest and resolves caller_name if supplied → legacy tool_type if supplied → a default. #2953 has since merged to axonflow-enterprise main and shipped in v9.11.0. #2903 (change the no-input default from "claude_code" to "unknown") was folded into that same merge, so the current server default is "unknown", not "claude_code". Neither this PR's Java-side changes nor its tests assert a specific default value for the neither-supplied case, so no follow-up is needed here for that default change.

Test plan

• AuditToolCallTest (WireMock): caller_name serializes standalone, legacy tool_type still serializes standalone, and both together (caller_name present, deprecated toolType still forwarded) — 3 new tests, all passing.
• runtime-e2e/caller_name_audit/CallerNameAuditTest.java: real AxonFlow#auditToolCall() against a live agent + orchestrator, reading the persisted row back via GET /api/v1/audit/{id} — proves callerName alone, legacy toolType alone, and both together all resolve to the correct policy_details.caller_name, with the legacy tool_type key no longer written for new rows. RESULT: PASS (4/4). (Originally run against an unmerged axonflow-enterprise branch carrying #2953; re-verified after #2953 merged — see follow-up PR for the current confirmation run and a stale-README fix.)
• ./mvnw verify — full suite: 1315 surefire tests + 12 failsafe tests, 0 failures, 0 errors.
• tests/fixtures/wire-shape-baseline.json — added a per_type_drift entry for AuditToolCallRequest marking caller_name as a known sdk_only field ahead of the pinned OpenAPI spec (getaxonflow/axonflow @ f910aa3d6c...) catching up; scripts/wire_shape/validate.py itself skips locally (no AXONFLOW_OPENAPI_SPECS_DIR) and only runs in the dedicated CI job.
• CHANGELOG.md — new Added bullet under [Unreleased], alongside the existing entries.

[gzak]

R3 review: wire-shape baseline claim independently verified accurate (cloned the pinned spec SHA, confirmed caller_name genuinely absent, ran scripts/wire_shape/validate.py for real — passes). One suggested improvement applied: added a prerequisite note to runtime-e2e/caller_name_audit/README.md disclosing that this test fails against axonflow-enterprise main until #2953 merges, so a future reader doesn't debug it as a flaky test.