Function log_read_audit 

pub fn log_read_audit(
    cli: &Cli,
    op: &str,
    key: Option<&str>,
    details: Option<&str>,
)

Log a read operation only if [audit] log_reads = true in config.

Used by get/list/run to optionally record read access.