Variable AUDIT_SINK_ABSENCE_POLICYConst

The declared-absence policy every bundled module that reads auditSink attaches to it (#363, the sink half of #287).

auditSink stays optional to wire — which sink is a configuration question — but not optional to decide: emitAuditEvent is a no-op on an empty slot, so a composition that simply never fills it discards every security event with no symptom, which is how the standalone template shipped eventless until #287. The template answers by always wiring a sink (audit.sink.type has no "none" builder there); every other composition answers here — wire a sink, or write audit.sink.type = "none" and own the decision in config.

One shared constant rather than three per-module copies, so the boot error's advice cannot depend on which module tripped it — the declared-absence guard refuses policies that disagree.