Function audit_log 

pub fn audit_log(
    path: &Path,
    now: DateTime<Utc>,
    requester_cn: &str,
    issued_cn: &str,
    not_after: DateTime<Utc>,
    context: &AuditContext,
)

Best-effort append; write failure warns but doesn’t fail issuance.