refactor(get trail, evaluate): fetch the trail through the Kosli API client

[dangrondahl]

Stacked on #1248. This is the first endpoint on the new internal/kosli client, and its first callers.

• internal/kosli/trails.go adds GetTrail(ctx, flow, name). It returns the raw *Result, not a typed trail. Neither caller reads typed fields yet: evaluate reshapes the trail as arbitrary JSON for Rego, and the get trail printers parse the raw body. The Trail struct should come with typing the get trail printer.
• get trail and fetchAndEnrichTrail (used by evaluate trail and evaluate trails) now go through kosliAPI().GetTrail. Their run takes (ctx, out, args), and RunE passes cmd.Context(). The UI links in get trail still build from global.Host.
• kosliAPI() in main.go builds a client from the current global flags, wrapped in the dry-run sender when --dry-run is set.

Why a function and not a package var

A kosliAPI var set in init panics on every start, because init runs before newRootCmd sets global.

Setting the var in PersistentPreRunE would avoid the panic, but it would still capture host, org and token at build time. Today every call site reads global at call time. Many test helpers set global directly and call run() without going through PersistentPreRunE, CreateFlow for example, so they would get a stale client once their commands migrate.

Building the client on each call costs one small allocation and keeps the current behaviour, including multi-host mode.

Verification

• internal/kosli has 3 new httptest tests: escaped path plus raw body, 404 → IsNotFound, and a dry run still reads the trail. make lint is clean.
• I compared a main binary with this branch's binary:
  • Error output is byte-identical. I used an unreachable host, with --dry-run and with -o json.
  • Success output is byte-identical. I used a local fake server returning the trail fixture from getTrail_markdown_test.go, and compared get trail -o table|json|markdown and evaluate trail --show-input -o json.
• I have not run the integration suites locally. I couldn't pull the pinned server image on this machine. CI covers them: GetTrailCommandTestSuite, EvaluateTrailCommandTestSuite and EvaluateTrailsCommandTestSuite.

operationId

GetTrail calls get_trail, which the server confirms. The package doc now says that each endpoint method's godoc names its operationId.

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes (no help text changes)
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR (n/a)
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed (n/a)

[claude]

Claude finished @dangrondahl's task in 1m 45s —— View job

---

Follow-up review complete

• Fetch prior review comments
• Diff c9552d91..2d1afdcd to scope review (the BEFORE sha in my instructions, ff4a1abd…, isn't reachable in this checkout/gh pr view --json commits, so I fell back to the PR's own commit list and scoped to the 3 newest commits: 25854d06, 3bece468, 2d1afdcd)
• Check status of each previous finding
• Check new commits for bugs/regressions in changed lines
• Post summary

Previous findings — both resolved:

1. cmd/kosli/getTrail.go — ctx stored on the options struct. Resolved by 25854d06. getTrailOptions, commonEvaluateOptions's ctx fields are gone; get trail, evaluate trail, evaluate trails now take ctx context.Context as the first run parameter, with RunE passing cmd.Context(). Verified no stray o.ctx references remain and the context import is used correctly in all three files.
2. internal/kosli/trails_test.go — missing dry-run coverage. Resolved by 3bece468, which adds TestGetTrailInADryRunStillReadsTheTrail. It wraps the sender in DryRun(...), calls GetTrail with a GET, and asserts the fake server was hit once and the raw body round-trips — correctly pins the dry-run-still-reads contract per dryRunSender's safe-method passthrough.

Both review threads on GitHub are already marked resolved.

New issues in the touched lines: none found. The signature threading (run(ctx, out, args) in getTrail.go, evaluateTrail.go, evaluateTrails.go) is consistent, imports are correct, and the new dry-run test correctly exercises newHTTPClient/New/DryRun/newFakeServer per the existing test helpers in client_test.go.

Note: I couldn't run go build/go vet/make lint or the integration suite in this sandbox (tool execution requires approval I don't have here), so this is a static review of the diff only — CI should still confirm GetTrailCommandTestSuite, EvaluateTrailCommandTestSuite, and EvaluateTrailsCommandTestSuite.