fix(audit): stop auditing console status polling; add apply and reboot details; reject unknown types #323

What happened

A v0.1.0 lab run of the audit log (row 11 of the release matrix) turned up three problems.

1. Status polling floods the log. The node console calls GetStatus and GetIdentity over the local socket every 2 seconds, and every call is audited. That is about 86,000 entries a day per node, roughly 97% of each log, and the Fleet Manager's node views add more over mTLS. The log lives on the state partition and has no size cap, so the noise is also a disk-exhaustion risk, and it buries the entries an auditor actually looks for.
2. ApplyConfig and Reboot entries carry no details. An ApplyConfig entry doesn't say which config generation or digest was applied or whether it needs a reboot, and a Reboot entry doesn't say whether the node rebooted or powered off. Only the request digest binds them.
3. An unknown --type quietly returns "(no audit entries)". cryptosctl audit list --type RevokeCert (a typo) prints an empty listing instead of an error, so an operator can't tell a typo from a quiet log.

Follow-up to #298.

Expected behavior

1. Read-only status polling (GetStatus, GetIdentity) is not recorded. Every state-changing call and every security-relevant read (exports, audit reads, config reads) is still recorded.
2. ApplyConfig entries record the config generation, the config digest and requires_reboot; Reboot entries record whether it was a reboot or a power-off. Both are covered by the entry signature and the hash chain.
3. The node rejects an unknown event type with InvalidArgument, and cryptosctl audit list --type reports it. The short method name (RevokeCertificate) and the full name (/cryptos.v1.NodeService/RevokeCertificate) both keep working.

Environment

CryptOS main, lab VM on ESXi, v0.1.0 validation matrix.