Support MDK epoch-stall backfill lifecycle audit rows

[agent-p1p]

Context

MDK issue marmot-protocol/mdk#1183 and draft PR marmot-protocol/mdk#1386 define explicit marmot-forensics-audit/v2 evidence for epoch-stall recovery. The final producer wire contract is:

• epoch_stall_backfill_armed (group-scoped): top-level group_ref; context.operation_id; kind fields stalled_epoch, threshold, optional trigger (undecryptable_threshold or resource_refusal).
• epoch_stall_backfill_started (account-scoped): context.operation_id; kind fields seam (startup, receive, explicit_catch_up, or maintenance), replay_scope (account_full_history), and retry_ordinal.
• epoch_stall_backfill_deferred (account-scoped): context.operation_id; kind fields reason (group_epoch_unavailable) and retry_ordinal.
• epoch_stall_backfill_completed (group-scoped): top-level group_ref; context.operation_id; kind fields retry_ordinal, duration_ms, activation_outcome (succeeded), deliveries, local_epoch_before, local_epoch_after, and group_advanced.
• epoch_stall_backfill_failed (group-scoped): top-level group_ref; context.operation_id; kind fields retry_ordinal, duration_ms, activation_outcome (succeeded or failed), optional privacy-safe error_kind, deliveries, local_epoch_before, local_epoch_after, and group_advanced.

The opaque context.operation_id correlates one recovery attempt across rows. The values are aggregate/typed and intentionally omit raw account IDs, group IDs, event IDs, relay URLs, credentials, and payload data. Group-scoped rows use the audit schema's existing privacy-safe group_ref projection rather than adding a raw group identifier.

Goggles currently preserves unknown kinds in raw evidence, but its copied v2 schema, ingest normalization, fixtures, and agent-state export tests do not explicitly cover these lifecycle rows or prove that every field survives export.

Acceptance criteria

• Sync docs/schemas/audit-log-event.v2.schema.json exactly with the producer schema from fix(marmot-app): audit epoch backfill lifecycle mdk#1386 after its lifecycle review fixes settle.
• Add ingest fixtures/tests for all five lifecycle kinds, including context.operation_id, applicable top-level group_ref, and every kind-specific field listed above.
• Prove the rows ingest as valid and the agent-state export preserves every field without exposing additional identifying data.
• Normalize/persist fields only where Goggles queries need them; do not duplicate raw kind/context evidence without a concrete query/export need.
• Keep the fixture and schema change compatible with existing v2 uploads.

Dependency

The wire shape is pinned above from marmot-protocol/mdk#1386. MDK #1183 must remain open until this Goggles ingest/export coverage lands; PR #1386 should not carry a closing reference while this dependency is outstanding.