feat: add complete audit log download helper

[yummybomb]

Summary

• add sync and async audit_logs.download helpers while retaining export_chunk for low-level access
• use gzip-compressed JSON Lines for high-level downloads; raw format selection remains on export_chunk
• verify checksums and reject missing, stalled, or cyclic cursor chains before writing each chunk
• preserve standard SDK HTTP retry behavior and make transfer retries configurable
• keep async hashing and destination writes off the event loop and await async progress callbacks
• document partial-output behavior

Testing

• full suite: 668 passed, 2591 skipped
• focused audit-log download tests: 23 passed
• Ruff, Pyright, and Mypy on changed files

---

Note

Medium Risk
New client surface for compliance exports with integrity and pagination rules; behavior is well-tested but failures can leave partial files on disk.

Overview
Adds sync and async audit_logs.download so callers can stream a full gzip JSONL export into a writable binary destination without hand-rolling cursor pagination on export_chunk.

A new kernel.lib.audit_log_download module drives the loop: it validates chunk headers (X-Has-More, X-Row-Count, X-Next-Cursor), verifies X-Content-Sha256 before writing, detects repeated cursors, retries transient read/checksum failures with configurable max_transfer_retries, and reports AuditLogDownloadProgress. The async path runs hashing and writes off the event loop and can await async progress callbacks.

AuditLogDownloadError, AuditLogDownloadResult, and AuditLogDownloadProgress are re-exported from the top-level kernel package. Docs note that failed downloads may leave partial output and recommend temp files plus atomic rename.

^{Reviewed by Cursor Bugbot for commit 3e2fcf9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e254579. Configure here.}