[major] Add durable Vault audit evidence

[libops-agent]

Outcome

The module now provisions a dedicated retained Cloud Logging bucket and exact Vault-audit sink, a scoped log view with explicit roles/logging.viewAccessor members, and a critical exports/error_count policy wired to explicit notification channels.

The audit location is an explicit customer/Legal choice. Retention is at least 365 days; Terraform prevents deletion, while the irreversible retention lock remains opt-in pending named business and Legal approval.

The companion Vault Init hardening is already merged in libops/vault-init#37, so an existing cloudrun/ device must verify JSON, HMACed accessors, non-raw values, and elided list responses.

Breaking configuration

Callers must now supply:

• audit_log_location
• audit_log_viewer_members
• audit_alert_notification_channels

Verification

• terraform validate
• terraform test (32 passed)
• TFLint v0.63.1
• terraform-docs v0.20.0 output check
• actionlint v1.7.12
• git diff --check

Evidence boundary

These checks establish a source and plan contract only. The included runbook requires applied bucket/sink exports, effective-access positive/negative tests, alert delivery, an authorized synthetic outage drill, and human Legal approval before claiming production evidence.