feat(sight): add --exclude filter to audit CLI for noise reduction

[jfeng18]

Summary

Add --exclude <pattern> flag (repeatable) to agentsight audit that hides process_action events whose filename or args contain the substring.

Dog-food testing showed 60%+ of audit events are cosh editor-detection noise (command -v cursor/vim/emacs/... at every startup). This makes audit output unusable without expert knowledge of --type llm.

Usage

# Before: 1345 events, 80% noise
agentsight audit --last 1

# After: noise filtered, hidden count reported
agentsight audit --last 1 --exclude "command -v"
# Last 1 hours: 550 audit events (795 hidden by --exclude)

# Multiple patterns
agentsight audit --last 1 --exclude "command -v" --exclude "grepconf"

Behavior

• Only ProcessAction events are matched; LlmCall events are never excluded
• Empty and whitespace-only patterns are silently ignored (prevents accidental match-all)
• Text mode: hidden count in header line
• JSON mode: hidden count on stderr, clean JSON array on stdout
• --summary + --exclude: warns that summary is unfiltered
• No --exclude: identical behavior to before (zero filtering)

What's NOT changed

• Default behavior (no --exclude) is unchanged
• Summary queries are unfiltered (warn if --exclude provided)
• No changes to storage/DB layer

Verification (ECS, 10 test cases)

Test	Result
Baseline (no exclude)	12272 events ✅
Basic exclude	11507 shown, 767 hidden ✅
Empty string --exclude ""	Same as baseline (ignored) ✅
Whitespace --exclude " "	Same as baseline (ignored via trim) ✅
--type llm + exclude	3 LLM events shown, NOT excluded ✅
JSON + exclude	Valid JSON + stderr hidden count ✅
Summary + exclude	Warns "not applied to summary" ✅
Nonexistent pattern	0 hidden ✅
cargo fmt --check	Clean ✅
LLM discriminating	3 events with/without exclude identical ✅

🤖 Generated with Claude Code