ADR: Custom roles audit model #587

Define how custom-role lifecycle events are audited: which events are recorded (create, rename/description edit, permission add/remove, duplicate, delete, member reassignment), what each record captures (actor, timestamp, role id, the specific change, scope where relevant), and how it relates to the existing RoleAssignmentData assignment audit and the AuthzSchemaSource provenance tables from ADR 0025.

Decide whether custom-role audit reuses/extends those models or gets dedicated tables, and whether the history is queryable via the API for a future UI surface. ADR 0025 explicitly defers source tracking for dynamically created definitions ("left to a future decision") — this ADR is that decision.

Create an ADR documenting the decision.