feat(audit): record cloud events without credentials via EventEmitterClient (#381)

Switch the audit cloudSink from the authenticated SyncClientBundle to
dry's new emit-only endpointsync.EventEmitterClient. Normal command
invocations now persist events to the local cloud-sync WAL without
resolving credentials or opening a data-plane connection; delivery
still happens only through the authenticated sync paths (pmg cloud
sync, sync-background auto-sync, and the proxy daemon drain), which
are unchanged.

Previously, running with cloud.enabled but no credentials skipped the
cloud sink entirely, so no events were recorded. Those events are now
staged in the WAL and sync once the user authenticates.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

internal/audit/cloud_client.go

@@ -124,12 +124,7 @@ func NewSyncClientBundle(cfg *config.RuntimeConfig) (*SyncClientBundle, error) {
 
 	identity := endpointsync.NewEndpointIdentityResolver(identityOpts...)
 
-	toolVersion := appVersion.Version
-	if toolVersion == "" {
-		toolVersion = "dev"
-	}
-
-	syncClient, err := endpointsync.NewSyncClient("pmg", toolVersion, transport, identity,
+	syncClient, err := endpointsync.NewSyncClient("pmg", pmgToolVersion(), transport, identity,
 		endpointsync.WithWALPath(cfg.CloudSyncDBPath()))
 	if err != nil {
 		if closeErr := cloudClient.Close(); closeErr != nil {
@@ -143,3 +138,12 @@ func NewSyncClientBundle(cfg *config.RuntimeConfig) (*SyncClientBundle, error) {
 		cloudClient: cloudClient,
 	}, nil
 }
+
+// pmgToolVersion returns the tool version stamped on cloud events, defaulting
+// to "dev" for local builds.
+func pmgToolVersion() string {
+	if appVersion.Version == "" {
+		return "dev"
+	}
+	return appVersion.Version
+}