CRE::Audit::BatchSealerScheduler

BatchSealerScheduler runs an idle fiber that periodically calls BatchSealer.seal_pending. Without this fiber the audit_batches table never grows and 'cre audit verify --merkle' has nothing to verify.

On each successful seal we publish AlertRaised(:info) with the sealed range; the AuditSubscriber then writes a 'audit.batch.sealed' event into the audit log itself, which closes the loop for compliance frameworks that key on that event_type.