feat: emit cloud events for dependency cooldown and host observations (#243)

* feat: emit cloud events for dependency cooldown and host observations (#237)

Wire cooldown blocks and proxy host observations through the cloud sync
pipeline so they appear as telemetry in Control Tower.

- Cooldown blocks emit PACKAGE_DECISION with COOLDOWN_BLOCKED action and
  PmgDependencyCooldown context (publish date, cooldown days, days since
  publish, days remaining)
- Proxy host observations emit HOST_OBSERVATION with PmgHostObservation
  (hostname, method)
- Session summary now includes cooldown_blocked_count
- Updated buf API dependency for new proto schema

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* format file

* fix: add explicit eventlog mapping for EventTypeDependencyCooldown

Follow the existing pattern where every audit event type has an explicit
case in mapEventType and a corresponding constant in the eventlog package.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Apply suggestion from @devin-ai-integration[bot]

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

---------

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

internal/audit/auditor.go

@@ -9,16 +9,17 @@ import (
 )
 
 type session struct {
-	mu               sync.Mutex
-	startTime        time.Time
-	packageManager   string
-	args             []string
-	totalAnalyzed    uint32
-	allowedCount     uint32
-	blockedCount     uint32
-	confirmedCount   uint32
-	trustedSkipped   uint32
-	insecureBypassed uint32
+	mu                   sync.Mutex
+	startTime            time.Time
+	packageManager       string
+	args                 []string
+	totalAnalyzed        uint32
+	allowedCount         uint32
+	blockedCount         uint32
+	confirmedCount       uint32
+	trustedSkipped       uint32
+	insecureBypassed     uint32
+	cooldownBlockedCount uint32
 }
 
 type auditor struct {
@@ -125,3 +126,14 @@ func (a *auditor) recordInsecureBypassed() {
 	s.insecureBypassed++
 	s.totalAnalyzed++
 }
+
+func (a *auditor) recordCooldownBlocked() {
+	s := a.getSession()
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.cooldownBlockedCount++
+	s.totalAnalyzed++
+}