refactor(policy-event): fold agent edr/dto.rs into wire submodule (#341)

Move ~2,900 lines of EDR wire DTOs from
`apps/agent/src-tauri/src/edr/dto.rs` (3,011 lines, 186 DTOs) into a new
`clawdstrike_policy_event::wire` module, split across 21 files by
functional cluster (health, findings, policy_events, developer_activity,
package_manager, endpoint_security, network_extension,
policy_event_history{,_causal}, privacy, causal_graph, secret_touches,
control_upload, simulation, policy_delta, daemon, response_actions,
evidence_bundles, receipts, protection_state, deception). Each file
stays under 500 lines; visibility widens from `pub(crate)` to `pub` so
control-api and SDKs can share a single source of truth.

The agent's `edr/dto.rs` shrinks to 216 lines: re-exports
`clawdstrike_policy_event::wire::*` and keeps only the 5 DTOs that
reference agent-private types (NetworkExtensionReloadRequestProof,
ControlResponseAckPostbackRoute, DaemonStatus, ProviderStatus,
StoredEndpointEvidenceBundle):

- EdrPolicyDeltaApplyResponse
- EdrPolicyDeltaApplyEnforcementProof
- EdrNetworkExtensionEgressPolicyProofResponse
- EdrControlAckPostbackRetryResponse
- EdrControlAckPostbackRetryAttemptRecord

Extension impls (`matches_index_entry`, `hydrate_attribution`,
`from_stored`) that hung off wire types and called agent-private helpers
become plain functions in the agent's `edr/dto.rs` to satisfy Rust's
orphan rule. Call sites are updated in `api_server.rs`,
`api_server/policy_history.rs`, `api_server/evidence_archives.rs`,
`edr/handlers/causal.rs`, `edr/handlers/response.rs`, and the test
fixtures.

`cargo build --workspace` and `cargo test -p clawdstrike-policy-event`
both pass clean; agent test count is unchanged (475 pass / 29 fail), and
the 29 failures pre-exist on `main` (verified via `git stash` before
applying this change).

Co-authored-by: bb-connor <bb-connor@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bb-connor

apps/agent/src-tauri/src/api_server.rs

@@ -2338,7 +2338,12 @@ async fn hydrate_response_execution_record_attribution(
     for record in records {
         let bundle_id = record.execution.evidence_bundle.bundle_id.as_str();
         match store.load(bundle_id) {
-            Ok(Some(stored)) => record.hydrate_attribution(&stored.graph),
+            Ok(Some(stored)) => {
+                crate::edr::dto::hydrate_response_execution_record_attribution(
+                    record,
+                    &stored.graph,
+                );
+            }
             Ok(None) => {}
             Err(err) => {
                 tracing::warn!(

apps/agent/src-tauri/src/api_server/evidence_archives.rs

@@ -27,7 +27,7 @@ pub(crate) async fn evidence_bundle_archive_response(
     let receipts = evidence_bundle_archive_receipts(state, &stored).await?;
     let archive = EdrEvidenceBundleArchive {
         bundle: stored.bundle.clone(),
-        artifact: EdrEvidenceBundleArtifact::from_stored(&stored),
+        artifact: crate::edr::dto::evidence_bundle_artifact_from_stored(&stored),
         graph: stored.graph,
         receipts,
     };

apps/agent/src-tauri/src/api_server/policy_history.rs

@@ -86,9 +86,21 @@ pub(crate) async fn select_policy_event_history_from_flight_recorder(
                 };
                 let event_kind_matches =
                     event_kinds.is_empty() || event_kinds.contains(entry.event_kind.as_str());
-                let identity_matches = identity_filters.matches_index_entry(entry);
-                let process_matches = process_filters.matches_index_entry(entry);
-                let target_matches = target_filters.matches_index_entry(entry);
+                let identity_matches =
+                    crate::edr::dto::edr_policy_event_history_identity_filters_matches_index_entry(
+                        &identity_filters,
+                        entry,
+                    );
+                let process_matches =
+                    crate::edr::dto::edr_policy_event_history_process_filters_matches_index_entry(
+                        &process_filters,
+                        entry,
+                    );
+                let target_matches =
+                    crate::edr::dto::edr_policy_event_history_target_filters_matches_index_entry(
+                        &target_filters,
+                        entry,
+                    );
                 time_matches
                     && event_kind_matches
                     && identity_matches

apps/agent/src-tauri/src/api_server/tests/policy_events/part_2.rs

@@ -1503,7 +1503,7 @@
         });
 
         let mut artifact_value =
-            serde_json::to_value(EdrEvidenceBundleArtifact::from_stored(&restored))
+            serde_json::to_value(crate::edr::dto::evidence_bundle_artifact_from_stored(&restored))
                 .unwrap_or_else(|err| panic!("failed to encode evidence bundle artifact: {err}"));
         artifact_value["shadowArtifactHash"] =
             serde_json::Value::String("must not be ignored".to_string());
@@ -1514,7 +1514,7 @@
 
         let mut archive_value = serde_json::to_value(EdrEvidenceBundleArchive {
             bundle: restored.bundle.clone(),
-            artifact: EdrEvidenceBundleArtifact::from_stored(&restored),
+            artifact: crate::edr::dto::evidence_bundle_artifact_from_stored(&restored),
             graph: restored.graph.clone(),
             receipts: Vec::new(),
         })