cli: replay command to rebuild from historical CloudTrail logs

[alsmola]

Adds trailtool replay, the second reset-and-replay primitive from #49 (design in #54, docs/design/cloudtrail-replay.md). With reset (#55), it gives a full rebuild: reset, then replay the range.

Replay lists historical CloudTrail objects in S3 and invokes the ingestor Lambda once per object with a synthetic S3 event, the same shape EventBridge delivers live. It adds no second ingestion path, so replayed and live data are identical.

Selection

• --prefix replays every object under an explicit S3 key prefix (the escape hatch for org trails or custom layouts).
• --from / --to (with --account and --region) expand to per-day CloudTrail key prefixes under AWSLogs/<account>/CloudTrail/<region>/YYYY/MM/DD/. Dates accept YYYY-MM-DD or RFC3339.

Listing is ascending, which for CloudTrail's date-partitioned keys is chronological. That ordering is what keeps windowed-fallback sessions and cross-file attribution behaving as they did live (design §6). Objects are filtered to gzipped event logs; Digest/Insight/Aggregated sidecars are skipped, matching the Lambda's own skips.

Execution

• Invocations run with bounded --concurrency (default 4). Synchronous invocation lets the driver observe per-object success and apply backpressure.
• A single object's failure is recorded, not fatal; failed keys are listed for targeted re-runs, and the command exits non-zero if any failed.
• A local resume cursor advances only past a contiguous run of successes, so an interrupted replay resumes without stranding a failed object below the cursor. --no-resume ignores it; --dry-run lists and counts without invoking.

Structure

core/replay holds the driver behind Lister / Invoker / Cursor interfaces. The AWS-backed S3 lister and Lambda invoker live in aws.go, separated from the pure loop so the driver is tested with fakes: ordering, filtering, resume-skip, contiguous high-water on partial failure, overlapping-prefix dedup, and dry-run, all under -race. Adds the s3, lambda, and aws-lambda-go/events dependencies.

Part of #49.

[alsmola]

Reworked to the corrected v1 after review. All four P1s and both P2s that touched replay are addressed:

• [P1] Concurrency vs. ordering — removed the worker pool and --concurrency. Replay is now strictly sequential: the next object is invoked only after the previous returns, so the ingestor sees objects in chronological order. Sequential is documented as a correctness requirement, not a knob.
• [P1] Cursor breaks the rebuild — removed the persistent FileCursor entirely. It survived a reset (a rebuild would skip everything and leave the projection empty) yet didn't survive a kill (saved only after the whole run). Replay is now stateless; a re-run relists the range and relies on the ingestor marker for in-window skip. A generation-bound checkpoint is a deferred follow-up.
• [P2] RFC3339 replays whole days — --from/--to are now date-only (YYYY-MM-DD). Sub-day instants are rejected, not silently rounded up.
• [P2] JSON reports partial replay as success — JSON mode now encodes the result and returns a non-nil error when any object failed, so scripted callers exit non-zero. New test locks this in.

Simplifications also applied: streamed listing with no whole-range buffer, sort, or cross-prefix dedup (the CLI only emits ordered single-account/region prefixes); help documents the no-overlap requirement.

The design doc's overlap claim (#54, finding P1 #3) is corrected there: the ingestor marker is a sequential-redelivery guard, not general idempotency, so overlap with live delivery is an explicit non-goal pending an atomic claim.

Now stacked on #55 (both previously inserted at the same main.go line). New tests: order preservation, cross-prefix order, failure-continue, context cancel, dry-run, selection validation, sub-day rejection, JSON failure exit code. go test ./..., go vet ./..., and go test -race all green.