Log rotation

The lifecycle log rotates on size, with a policy under the audit retention
settings — by default 100 MB, ninety days, twelve archives, gzip-compressed.
Rotation is amortised: the append path only considers rotating every hundredth
write, so the common case costs nothing.

The rotation sequence is ordered to close a data-loss window. The live file is
renamed first — an atomic operation, so a concurrent writer either landed in
the old file or will land in the fresh one — then a new empty log is created, and
only then is the renamed file filtered by age and written out as a compressed
archive. Undecodable lines are kept, not dropped, on the principle that a
corrupt audit line is still evidence.

Archives follow one naming convention with three consumers: the rotator writes
them, the audit timeline's event reader globs them so a query spanning a rotation
boundary still returns the archived entries, and the audit shipper ships them.