feat: structured events + log rotation/retention

[arcaven]

Summary

Two observability features landed together because they share the same motivation — operators need bounded, queryable signal on low-quota hosts like the desk Pi.

• k0t / events — structured state-transition ring. Complements marvel daemon logs (raw stderr stream) with queryable, severity-tagged event history. Marvel's equivalent of `kubectl get events`.
• Log rotation — --log-file now rotates by size, gzip-compresses archives, enforces count + total-bytes retention, and has a stub `Shipper` hook so remote-offload can land later without touching the writer.

Closes ticket 0og (audit completed separately — no code changes needed, both optional-valued flags already had `NoOptDefVal` set).

New CLI surface

`marvel events`

Top-level command, remote-capable via mrvl://.

```sh
marvel events # last 100 events
marvel events -n 500
marvel events --session demo/shell-g1-0 # filter by session key
marvel events --workspace demo
marvel events --kind session.crashed
marvel events --warnings # severity filter
marvel --cluster desk events # remote via mrvl://
```

Emitted event kinds: `session.created`, `session.deleted`, `session.crashed`, `session.restarted`, `health.failed`, `health.crashloop-backoff`, `role.saturated`, `team.shift-started`, `team.shift-completed`.

`marvel daemon --log-max-*` flags

New on `marvel daemon`:

• `--log-max-size 10` — rotate at 10 MiB (default)
• `--log-max-files 5` — keep 5 gzipped archives (default)
• `--log-max-total 0` — total disk-usage cap in MiB (0 disables; off by default so existing setups keep working unchanged)

Zero in any slot disables that specific limit. Archives land alongside the active file as `daemon.log.20260418T183045Z.gz` — lexicographic sort == chronological, oldest-first retention.

Design notes

• `internal/events` — bounded ring, filterable snapshot, nil-safe `Emit` helper so producers that don't have a ring injected still run. Default capacity 2000.
• `internal/rlog` — `io.WriteCloser` that owns rotation + gzip + retention. `Shipper` interface with `NoopShipper` default — real transports (scp, s3, rsync) are a separate probe.
• Emission sites: `session.Manager.Create/Delete/ReapDead` and `team.Controller.restartSession/evaluateHealth/InitiateShift/reconcileShift`. Saturation + CrashLoopBackOff events emit on the tick they're first detected, not every tick, so the ring doesn't fill up with repeated transitions.

Test plan

• `internal/events` unit tests — ring append/overflow, filters, nil-safe emit, concurrent writes (-race)
• `internal/rlog` unit tests — size rotation, count retention, total-bytes retention, shipper invoked on rotation, empty-file no-op, append preserves across reopens
• Full marvel suite green (`go test ./...` + `-race`)
• `golangci-lint run` clean (0 issues)
• Manual: start `marvel daemon`, work a manifest, run `marvel events` — to be done on the desk alpha once built

Related

• Defers aae-orc-4wz (RRD-style dedup) — complementary idea; the dedup layer would sit in `internal/logbuf` not `events`.
• Defers aae-orc-1d2 (ssh poll noise); dedup is the right hammer for that, not events.

Refs: aae-orc-k0t, Skippy session-025/026 raspi feedback