refactor(monitoring): N2 - tach monitoring_tab.py, CanonicalAuditLogger, MonitoringQueryService, go circular import, sandbox matrix

- ui/monitoring_tab.py (1546 dong) tach thanh presentation/monitoring/**
  (container + 7 tab/card + shared helper), ui/monitoring_tab.py con lai
  re-export shim de app.py khong doi.
- infrastructure/telemetry/audit_logger.py: CanonicalAuditLogger, core/audit_log.py
  thanh wrapper mong, tuong thich nguoc 100% voi schema .jsonl cu.
- application/monitoring/monitoring_query_service.py: MonitoringQueryService
  read-only, filter/sort/pagination, khong import PySide6.
- Go circular import model_pricing<->usage_tracker va agent_security<->
  agent_security_alert (core/agent_security_types.py moi).
- infrastructure/sandbox/sandbox_capabilities.py: SandboxCapabilityMatrix
  theo OS (Windows/Linux/macOS), chua dau noi vao core/sandbox_manager.py.
- conftest.py: sua loi checkout khong ten cowork_local khien pytest import
  nham thu muc khac.
- 77 test moi, 167/167 pass. QA da xac nhan UI/business logic khong doi
  (xem evidence/report/unified_report.html).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_monitoring_event_tabs.py

@@ -0,0 +1,59 @@
+"""Task 1 (sub-step 6c) — SecurityEventsTab / McpTab / ActionLogsTab.
+
+Widget smoke tests against the offscreen QPA platform (see
+test_monitoring_event_widgets.py for why no pytest-qt is needed). Verifies
+each tab wires build_filter_scaffold correctly, exposes the attributes the
+container's retranslate loop needs, and forwards set_events to its table.
+"""
+from __future__ import annotations
+
+import os
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+import pytest
+
+QApplication = pytest.importorskip("PySide6.QtWidgets").QApplication
+
+from cowork_local.presentation.monitoring.tabs.action_logs_tab import ActionLogsTab
+from cowork_local.presentation.monitoring.tabs.mcp_tab import McpTab
+from cowork_local.presentation.monitoring.tabs.security_events_tab import SecurityEventsTab
+
+
+@pytest.fixture(scope="module")
+def qapp():
+    app = QApplication.instance() or QApplication([])
+    yield app
+
+
+@pytest.mark.parametrize("cls,expected_title_key", [
+    (SecurityEventsTab, "monitoring.security_events_title"),
+    (McpTab, "monitoring.mcp_history_title"),
+    (ActionLogsTab, "monitoring.action_logs_title"),
+])
+def test_tab_exposes_container_facing_attributes(qapp, cls, expected_title_key) -> None:
+    refresh_calls = []
+    tab = cls(ctx=None, on_refresh_all=lambda: refresh_calls.append(1))
+    assert tab.title_key == expected_title_key
+    assert tab.filter_edit is not None
+    assert tab.detail_panel is not None
+
+    tab.title_refresh_btn.click()
+    assert refresh_calls == [1]
+
+
+def test_set_events_forwards_to_table(qapp) -> None:
+    tab = SecurityEventsTab(ctx=None, on_refresh_all=lambda: None)
+    tab.set_events([{"ts": "2026-01-01T00:00:00", "kind": "security_block", "name": "x",
+                     "ok": False, "detail": "d", "account": "a", "machine": "m"}])
+    assert tab.table.rowCount() == 1
+
+
+def test_retranslate_does_not_raise(qapp) -> None:
+    tab = McpTab(ctx=None, on_refresh_all=lambda: None)
+    tab.retranslate()  # must not raise
+
+
+def test_ai_filter_noop_when_search_box_empty(qapp) -> None:
+    tab = ActionLogsTab(ctx=None, on_refresh_all=lambda: None)
+    tab.ai_filter_btn.click()  # empty search text -> start_ai_filter no-ops, must not raise