Download the scope's 2-year audit trail as CSV or JSON

Streams the caller's rows of the append-only 2-year audit store (one row per terminal operation) for an explicit [from, to) window as a file attachment. This is NOT the 90-day activity feed (GET /scopes/{scopeId}/activity/activity-events, which lists Operations): the audit store outlives the operation retention. Visibility is the feed's: rows of the scope's own project plus the tenant-level rows (no project) of the scope's tenant, ordered oldest-first by occurredAt. format=csv (default) streams text/csv; charset=utf-8 with a header row of the twelve AuditExportRecord columns in declaration order; a cell a spreadsheet would evaluate as a formula (leading =, +, - or @) is prefixed with ' (CSV-injection guard). format=json streams application/json: one array of AuditExportRecord objects. In both formats an absent value is the empty string, never null. The attachment is named audit-<tenantId>-<fromYYYYMMDD>-<toYYYYMMDD>.<format>; X-Audit-Row-Count carries the row count, computed before the stream starts. Validation: scopeId must resolve to a scope the caller can reach (unknown or unauthorized → 404 NOT_FOUND, per the 404-not-403 rule); from and to are both required ISO-8601 instants (a value without an offset is read as UTC); to must be after from (field to); the window may span at most 731 days (field from); a window holding more than 200000 rows is refused (field from: narrow the range); format must be csv or json — every violation → 422 VALIDATION_FAILED. RBAC: READ on the audit permission-matrix key (owner, contributor and reader hold it; billing-ops does not) plus the iam:read token scope for a bearer. Async & state: Synchronous streamed read. The export itself is recorded as a SUCCEEDED iam.audit.export operation, so downloading the audit trail is audited too. Errors: 401 unauthenticated; 403 caller's role lacks audit READ, or the bearer lacks the iam:read scope; 404 unknown or unreachable scopeId; 422 invalid window or format; 500 unexpected failure. Idempotency/Concurrency: Safe to repeat; each download records its own export operation. No Idempotency-Key is required.