denylist-gate: add a test asserting audit-log integration is truly opt-in (behavior unchanged when unset)

[Idaonoli]

Scope

set_audit_log wires an opt-in cross-contract call into add_to_denylist/remove_from_denylist via maybe_record. The module doc comment explicitly promises "If set_audit_log is never called the behaviour is identical to before", but there's no test pinning that guarantee — a future change to maybe_record could silently break it without any test catching the regression.

Acceptance criteria

• Add a test that performs add/remove operations on a denylist-gate instance with no audit-log configured, and asserts behavior (return values, events, storage state) is unchanged from before the audit-log feature existed