feat: add nova_audit_pgo adapter + dependency model docs

[Taure]

Summary

• Adds nova_audit_pgo — a third sibling OTP app that writes audit events directly via pgo, for consumers who don't want Kura as a transitive dep.
• Documents the dependency model so consumers know exactly what they need when they take a dep on nova_audit.

Why

Question from a consumer: "If I take nova_audit, do I have to pull every adapter's underlying library?" Answer: no — adapters use the soft-dep pattern (erlang:function_exported/3 runtime checks). But the docs didn't make that clear. This PR fixes both: ships pgo as a turnkey alternative AND documents the pattern.

Dependency model

You add	You actually need
nova_audit only	jhn_stdlib. Adapters compile but only nova_audit_log works.
nova_audit + use nova_audit_kura	Add kura to your deps.
nova_audit + use nova_audit_pgo	Add pgo to your deps.
nova_audit + custom adapter	Whatever your adapter needs. Nothing else.

Adapter

• pgo:query/3 for both write and query paths.
• Same table schema as the Kura adapter; nova_audit_pgo:schema_sql/0 delegates to nova_audit_kura:schema_sql/0 for one source of truth.
• Cursor-paginated query/3 (cursor = last occurred_at).
• pgo_not_loaded error if pgo is not in the consumer's deps.

Tests

• nova_audit_pgo_SUITE — 5 tests: registry registration, schema_sql, hardening_sql, write/query returning pgo_not_loaded when pgo isn't there.

Docs

• guides/adapters.md expanded with the dependency table, the pgo adapter section, and a complete "writing your own adapter" walkthrough including the worker + registry sequence.

Test plan

• rebar3 compile clean
• rebar3 ct — 16/16 pass (was 11; +5 from pgo suite)
• rebar3 xref clean
• rebar3 dialyzer clean
• rebar3 hank clean
• rebar3 fmt --check clean
• CI green

[github-actions]

ℹ️ 15 OTP CVEs auto-ignored (already fixed in running version)

These CVEs are patched in the installed OTP version but NVD data
has not been updated to reflect this. They are excluded from the
scan via an auto-generated .trivyignore.

CVE	Details
CVE-2026-32147	Fixed in 28.4.3, running 28.5 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot
CVE-2026-28808	Fixed in 28.4.2, running 28.5 — ScriptAlias CGI targets bypass directory auth (mod_auth vs mod_cgi path mismatch)
CVE-2026-32144	Fixed in 28.4.2, running 28.5 — OCSP designated-responder authorization bypass — missing signature verification (RFC 6960 §4.2.2.2)
CVE-2026-28810	Fixed in 28.4.2, running 28.5 — Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
CVE-2026-23943	Fixed in 28.4.1, running 28.5 — Pre-auth SSH DoS via unbounded zlib inflate
CVE-2026-23942	Fixed in 28.4.1, running 28.5 — SFTP root escape via component-agnostic prefix check in ssh_sftpd
CVE-2026-23941	Fixed in 28.4.1, running 28.5 — Request smuggling via first-wins Content-Length parsing in inets httpd
CVE-2026-21620	Fixed in 28.3.2, running 28.5 — TFTP Path Traversal
CVE-2016-1000107	Fixed in 28.0.4, running 28.5 — Httpd CGI Scripts Environment Variable Pollution AKA "httpoxy"
CVE-2025-58050	Fixed in 28.0.3, running 28.5 — Buffer Read Overflow on Regular Expressions with (*scs:) and (*ACCEPT)
CVE-2025-48038	Fixed in 28.0.3, running 28.5 — SSH Unverified File Handles can Cause Excessive Use of System Resources
CVE-2025-48039	Fixed in 28.0.3, running 28.5 — SSH Unverified Paths can Cause Excessive Use of System Resources
CVE-2025-48040	Fixed in 28.0.3, running 28.5 — SSH Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
CVE-2025-48041	Fixed in 28.0.3, running 28.5 — SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
CVE-2025-4748	Fixed in 28.0.1, running 28.5 — Absolute Path in Zip Module