Missing tests

From test validation of PR #2293:

1. ClaimSource serde roundtrip — no test verifies that all variants serialize and deserialize correctly
2. AuditEntry.claim_source JSON serialization — no test verifies that the field is omitted when None and present with correct value when Some

Component

crates/zeph-tools/src/executor.rs, crates/zeph-tools/src/audit.rs