Built-in result-to-audit-outcome classifiers.

:default is used when a call does not set :classify. It records a failure when the callback returned :error or {:error, reason} and a success otherwise, so an audited operation is never recorded as successful merely because it did not raise.

A custom classifier is a one-argument function returning :success, :failure, :unknown, or a non-empty outcome string.

:unknown is a real outcome rather than a gap to be filled in. A classifier that cannot tell what happened has two dishonest options and one honest one: recording success hides failures, recording failure invents them, and saying so leaves a record an investigator can act on. The stricter classifiers return it freely for that reason.