Log manual repository role changes for engineering leads before audits

Your repo role changes arrive untracked, causing permission drift and audit gaps. Give engineering leads and security a single audit log before the next compliance review.