Add audit-logs export commands for S3 export destinations

[yummybomb]

Summary

Adds a kernel audit-logs export command group for managing S3 audit log export destinations:

• create — creates a destination (paused by default) and prints the trust-policy onboarding steps with the Kernel role ARN and external ID
• list — paginated table with delivery status per destination (--limit/--offset, more-results hint from pagination headers)
• get — full detail view including delivery status: status, last success with computed lag, last error and time, consecutive failures, next attempt
• update — partial update of region/bucket/prefix/role ARN/KMS key; --clear-kms-key sends an empty string to remove the key, omitted flags leave fields unchanged; 409 conflicts get a retry-against-fresh-state hint
• pause / resume — status transitions with notes on in-flight uploads and resume semantics
• delete — removes a destination
• test — runs the destination test and exits non-zero on failure, reporting the failing stage and error code

These endpoints have no generated SDK surface, so the command defines local request/response types and calls them through the raw kernel.Client request methods, following the existing cmd/audit_logs.go service-interface pattern. All subcommands support --output json.

Testing

• make test passes (27 new table-driven unit tests with a fake service, covering output rendering, flag validation, partial-update/clear semantics, pagination hints, 409 handling, and test-failure exit behavior)
• All flows (create, get, list, update incl. KMS set/clear, pause/resume, test, delete, and error paths) were exercised end-to-end against a live environment with the built binary