Add `dotagent audit` — query and format the audit log

The audit log at `~/.config/dotagent/state/audit.log` records every meaningful event: `agent_run`, `preflight_failed`, `plugin_invoked`, `manifest_loaded`, `manifest_drift_detected`, `agent_recovered`, `agent_given_up`. It is JSON Lines, which is great for `jq` but not great for humans.

There is no first-class way to query it.

## Proposal

A new subcommand:

```
dotagent audit # last 50 events, all kinds
dotagent audit --since 7d # time window
dotagent audit --agent hello-fish # filter by agent
dotagent audit --kind preflight_failed # filter by event kind
dotagent audit --kind preflight_failed,given_up # multi-kind
dotagent audit --json # raw NDJSON pipe-friendly
```

Default output formats the event by kind:

```
2026-05-19 10:15:01 preflight_failed databricks-cost-daily/morning plugin=preflight-warp suggest="install warp first"
2026-05-19 10:13:00 agent_run databricks-cost-daily/morning exit=0 duration=12s
2026-05-19 09:13:00 manifest_drift_detected hello-fish sha=a1b2..→c3d4..
```

## Acceptance criteria

- [ ] Reads from the existing audit log file. No new persistence.
- [ ] Default sort is reverse chronological (newest first).
- [ ] Filters compose (`--since 7d --agent X --kind Y`).
- [ ] `--json` emits the audit log records verbatim, one per line, suitable for piping to `jq`.
- [ ] When the log is rotated, history across rotations is read transparently.

## Where to start

- `crates/dotagent-state/src/audit.rs` — event kinds + log format.
- `crates/dotagent/src/commands/output.rs` — shared rendering.

## Non-goals

- Mutating the log. Read-only.
- Aggregation (counts/rates). That is what the Prometheus metrics endpoint is for.

Start with crates/dotagent-state/src/audit.rs to understand the event kinds, JSON Lines format, and rotated log files, then read crates/dotagent/src/commands/output.rs for shared rendering. Implement the read-only audit query with composed filters, reverse-chronological default output, formatted and verbatim JSON modes, and transparent rotation handling. Done means all listed command examples and acceptance criteria work.

Written by the indexing model from the issue text.