feat: emit cloud events for dependency cooldown and host observations (#243)

* feat: emit cloud events for dependency cooldown and host observations (#237)

Wire cooldown blocks and proxy host observations through the cloud sync
pipeline so they appear as telemetry in Control Tower.

- Cooldown blocks emit PACKAGE_DECISION with COOLDOWN_BLOCKED action and
  PmgDependencyCooldown context (publish date, cooldown days, days since
  publish, days remaining)
- Proxy host observations emit HOST_OBSERVATION with PmgHostObservation
  (hostname, method)
- Session summary now includes cooldown_blocked_count
- Updated buf API dependency for new proto schema

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* format file

* fix: add explicit eventlog mapping for EventTypeDependencyCooldown

Follow the existing pattern where every audit event type has an explicit
case in mapEventType and a corresponding constant in the eventlog package.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Apply suggestion from @devin-ai-integration[bot]

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

---------

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

internal/audit/audit.go

@@ -199,6 +199,23 @@ func LogProxyHostObserved(hostname, method, reason string, details map[string]in
 	})
 }
 
+// LogDependencyCooldown records that a package was blocked by the dependency cooldown policy.
+func LogDependencyCooldown(pv *packagev1.PackageVersion, publishDate time.Time, cooldownDays, daysAgo, daysLeft int) {
+	logEvent(AuditEvent{
+		Type:           EventTypeDependencyCooldown,
+		Message:        fmt.Sprintf("Package blocked by cooldown policy: %s@%s (published %d days ago, %d days remaining)", pkgName(pv), pkgVersion(pv), daysAgo, daysLeft),
+		PackageVersion: pv,
+		PublishDate:    publishDate,
+		CooldownDays:   cooldownDays,
+		DaysAgo:        daysAgo,
+		DaysLeft:       daysLeft,
+	})
+
+	if global != nil {
+		global.recordCooldownBlocked()
+	}
+}
+
 // LogSandboxOverride records that runtime sandbox policy overrides were applied.
 func LogSandboxOverride(sandboxProfile string, overrides []map[string]string) {
 	logEvent(AuditEvent{
@@ -250,19 +267,20 @@ func LogSessionComplete(outcome Outcome, flowType FlowType) {
 		Type:    EventTypeSessionComplete,
 		Message: fmt.Sprintf("Session complete: %s", outcome),
 		SessionData: &SessionData{
-			PackageManager:    s.packageManager,
-			FlowType:          flowType,
-			Outcome:           outcome,
-			TotalAnalyzed:     s.totalAnalyzed,
-			AllowedCount:      s.allowedCount,
-			BlockedCount:      s.blockedCount,
-			ConfirmedCount:    s.confirmedCount,
-			TrustedSkipped:    s.trustedSkipped,
-			InsecureBypassed:  s.insecureBypassed,
-			Duration:          time.Since(s.startTime),
-			SandboxEnabled:    cfg.Config.Sandbox.Enabled,
-			ParanoidMode:      cfg.Config.Paranoid,
-			TransitiveEnabled: cfg.Config.Transitive,
+			PackageManager:       s.packageManager,
+			FlowType:             flowType,
+			Outcome:              outcome,
+			TotalAnalyzed:        s.totalAnalyzed,
+			AllowedCount:         s.allowedCount,
+			BlockedCount:         s.blockedCount,
+			ConfirmedCount:       s.confirmedCount,
+			TrustedSkipped:       s.trustedSkipped,
+			InsecureBypassed:     s.insecureBypassed,
+			CooldownBlockedCount: s.cooldownBlockedCount,
+			Duration:             time.Since(s.startTime),
+			SandboxEnabled:       cfg.Config.Sandbox.Enabled,
+			ParanoidMode:         cfg.Config.Paranoid,
+			TransitiveEnabled:    cfg.Config.Transitive,
 		},
 	})
 }