Audit and meter public debug operations

scripts/cli-first-contract-smoke.js

@@ -161,6 +161,21 @@ expect(
   "coordinator task restart boundary coverage",
   /fn service_reports_task_restart_boundary_through_public_api\(\)/
 );
+expect(
+  coordinator,
+  "public debug operation audit event",
+  /pub struct DebugAuditEvent[\s\S]*charged_debug_read_bytes[\s\S]*used_debug_read_bytes/
+);
+expect(
+  coordinator,
+  "public debug operation metering",
+  /record_debug_audit_event\([\s\S]*LimitKind::DebugReadBytes[\s\S]*DEBUG_CONTROL_READ_BYTES/
+);
+expect(
+  cli,
+  "CLI surfaces debug audit and quota fields",
+  /debug_reads_quota_limited[\s\S]*charged_debug_read_bytes[\s\S]*used_debug_read_bytes/
+);
 
 for (const [name, pattern] of [
   ["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],