Add audit-logs download command

[yummybomb]

Summary

Adds kernel audit-logs download for verified chunked audit-log exports.

• Requires an explicit, exclusive [start, end) range of at most 30 days.
• Downloads gzip-compressed JSONL with no alternate format modes.
• Walks the API cursor sequentially and verifies every source chunk checksum before processing it.
• Retries transient per-chunk failures (network errors, 429/5xx, checksum mismatches) up to 7 attempts (6 retries) with capped exponential backoff (~31s total) before failing the download.
• Uses the SDK's multi-value method exclusions to send the default GET exclusion and --exclude-method together to the API.
• Writes to an adjacent .partial file (replacing any stale one from a prior run) and publishes the final .jsonl.gz only after all chunks complete.
• Removes incomplete partial output after transfer failures and preserves a completed partial if final publication fails.
• Refuses to replace an existing output unless --force is passed; forced replacement happens only during the final rename.
• Chunk requests disable the SDK's built-in retries so the download's own retry policy is authoritative.

Test plan

• go test ./...
• go vet ./...
• Race-enabled audit-log tests
• Windows amd64 test-binary cross-compile
• Stacked method exclusions match search and download semantics
• Finalization failures preserve completed partial and existing output files
• Live download smoke test with stacked GET and POST exclusions
• SDK retry suppression asserted against a real httptest server
• Checksum-mismatch recovery and stale-partial overwrite tests

---

Note

Medium Risk
New CLI path writes sensitive audit data to disk with careful partial-file handling; behavior is well tested but touches export APIs and local file I/O.

Overview
Adds kernel audit-logs download for bulk export of gzip-compressed JSONL over a required exclusive [start, end) window (max 30 days), reusing the same filter flags as search (including default GET exclusion via auditLogExcludeMethods).

The implementation pages through ExportChunk, validates each response with X-Content-Sha256 and pagination headers, and applies its own retry policy (up to 7 attempts, capped backoff; SDK retries disabled) for transient failures. Output is written to a .partial file with restrictive permissions and only renamed to the final path after all chunks succeed; failed runs drop the partial, and a completed partial is kept if final rename fails. --force is required to overwrite an existing destination.

AuditLogsService gains ExportChunk; tests cover multi-chunk assembly, retries, checksum/header validation, overwrite semantics, and finalize edge cases.

^{Reviewed by Cursor Bugbot for commit 0cda746. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ee8ccd4. Configure here.}

[pulumi]

⚠️ Pulumi could not deploy preview(s) for this pull request because GitHub reports it is not mergeable (mergeable state: dirty). This usually means the branch has merge conflicts with its base branch. Resolve the conflicts and push a new commit to retry.

[sjmiller609]

looks good, either as follow up or before merge, maybe you want to test interrupting one of the chunk downloads, e.g. cut your wifi then turn it back on, see if it can retry the missed chunks properly