work-items: audit a keyed replay once, not per retry #355

Follow-up from the #354 review (P3, carried over): AttachWorkItemExecution and TransitionWorkItem write an audit row on every call, including a pure idempotent replay where the store wrote nothing. N retries of one keyed request behind a flaky proxy become N audit rows for one event.

created is not the right gate for attach (a genuine phase advance also returns created == false), and Transition returns no such flag. The fix is for the store to report "nothing changed" (a replay) alongside its current returns, and for both handlers to audit only real changes.

Refs #349, #354.