Add module event producer coverage

docs/EVENTS_AND_AUDIT.md

@@ -14,6 +14,12 @@ dispatch**:
 - Use `govoplan_core.core.events.PlatformEvent` for domain and platform events.
 - Use `EventBus` as the in-process dispatch contract for same-process module
   reactions that are safe to run inline.
+- Use the shared `audit_event` / `audit_from_principal` helper for audited
+  module actions. The helper persists the audit row and immediately publishes a
+  governed `PlatformEvent` whose `type` is the audit action.
+- Use `record_change` for module delta feeds. It persists the change-sequence
+  row and immediately publishes a generic module change event such as
+  `mail.profile.updated`.
 - Persist durable integration/workflow events through a database outbox before
   acknowledging the state change that produced them.
 - Drain the outbox through a small dispatcher process. The dispatcher may call
@@ -75,7 +81,9 @@ otherwise it generates a new ID. Responses include `X-Correlation-ID`.
 
 Audit logging reads the current event context and stores trace IDs in
 `details._trace`. Callers can also pass explicit `correlation_id` and
-`causation_id` to `audit_event` or `audit_from_principal`.
+`causation_id` to `audit_event` or `audit_from_principal`. The same trace is
+copied into the emitted `PlatformEvent`, so audit rows and event subscribers can
+be correlated without route-specific glue code.
 
 Admin and lifecycle code should use the compact operational detail shape
 documented in `govoplan-audit/docs/AUDIT_TRACE_CONTEXT.md`. The core
@@ -99,8 +107,11 @@ additional detail values.
 - the compatibility `audit_event` helper while routes are still migrating
 - retention orchestration that calls module capabilities
 
-Feature modules should record audit facts through a small audit API or future
-`audit.sink` capability. They should not import audit storage internals.
+Feature modules should record audit facts through the shared helper or a future
+`audit.sink` capability. They should not import audit storage internals. Module
+state changes that only need delta-feed visibility should go through
+`record_change`; route-level business actions should still record a semantic
+audit action.
 
 ## Initial Domain Event Inventory