feat: ingest audit logs from edge control planes

[scotwells]

Summary

When a customer acts against an edge control plane, that cluster's own API server audits it — not the core control plane. None of it reached the customer's project, so their audit trail stopped at the boundary of where their workloads actually run. Edge requests now show up in the owning project, attributed correctly and filterable by location alongside every other audit record.

Those records can't simply be replayed. Edge control planes are downstream clusters, so a raw edge audit record names internal ns-<uid> namespaces the customer has never seen and must never be shown — and it carries no usable tenant, so replayed unchanged it lands in the platform bucket, the one place every operator can read it. A new ingest subcommand receives audit batches from edge control planes, reverses that namespace mapping, attributes each record to the owning project, stamps its location, and republishes onto the audit stream the core pipeline already consumes — so storage, translation and query need no edge-specific handling. It's a new subcommand because nothing today receives audit over the wire: the processor consumes an already-populated stream, and the event exporter handles Events, not audit.

The shipper asserts nothing about itself. Cluster identity and location come from the authenticated client certificate and a registry rendered by infrastructure; tenancy and location arriving in a payload are overwritten, not merged. The reverse index is built from upstream project namespaces rather than by reading edge clusters, so ingest holds no credential into any edge cluster and a compromised site can't influence what a namespace resolves to. Namespaces are un-mapped everywhere they appear — requestURI included, which is the one that hides — and a final scan drops any record where one survived. Unresolvable records are dropped and counted rather than filed under a guess; a cold cache is retried rather than mistaken for an unknown tenant; and mappings are retained after a namespace is deleted so older records keep resolving for their full retention window.

Note

Unresolved, and wanted in review. #228 decides edge Events ship per-cluster over NATS nkeys and explicitly rejects a central collector; this is central and mTLS. Audit differs because its shipper is the edge kube-apiserver's own audit webhook backend, which speaks TLS and not NATS — there's no edge-side process to hand an nkey to without building one. But two edge paths with two credential models is a real cost and that RFC is still proposed, so I'd rather this were argued now than discovered later.

Out of scope: location as an Activity facet (needs ActivitySpec.Source, owned by #228), deployment manifests, and core control plane audit, which already reaches the stream directly and needs no rewriting.

Related to #228. Depends on milo-os/milo#769, which owns the canonical reverse lookup — this branch carries a mirrored copy with a TODO to delete it, since importing it today would pull k8s.io/kubernetes into this server's build graph.

Test plan

• go build ./..., go vet ./... and the full go test ./... suite green; no existing package regressed
• 34 unit tests covering registry identity, index retention and restart persistence, cold-cache park-and-retry, and each un-mapped field
• mTLS listener: unregistered certificate rejected, anonymous handshake refused, readiness red until caches sync while liveness stays green, cold cache asks the shipper to retry
• End to end against real ClickHouse, NATS and mTLS (task e2e:edge-audit) — recorded audit fixtures shipped in, then queried back through the storage layer
• …covering: project record lands in its project with no internal namespace anywhere in the result, requestURI asserted explicitly; platform-scoped request not misfiled into a project; unresolvable record never stored under any scope; record about a deleted namespace still resolves; payload-claimed tenancy overwritten; one project can't see another's records; location filter and facet return the expected rows
• Deployed to a cluster — blocked on the manifests noted above