docs(audit): Parquet cold archive shipped, default off (ScadaBridge#42)

Component-AuditLog Retention & Purge describes the archive: directory and
layout, the three files, consistency with the hash chain (SHARED read,
guarded switch, anchor = archived chain end), fail-closed purge, retention
interplay (per-channel overrides are not archived, their tombstones are),
verify/read, and the AuditLog:Archive configuration. alog.md §13.6/§15.2/§16,
CLAUDE.md, HighLevelReqs AL-12, Component-CLI, Component-ManagementService,
docs/components/{CLI,ManagementService}.md and the CLI README drop the
"deferred / 501" wording and document `audit archive list|verify` and the
parquet export.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

docs/requirements/Component-CLI.md

@@ -304,7 +304,8 @@ The `scadabridge audit` group targets the centralized Audit Log component (#23)
 exposes the UI-equivalent operational audit surface. Permissions follow the same
 read-vs-export split the Central UI uses (see Component-AuditLog.md, Security &
 Tamper-Evidence, and Security & Auth #10): `audit query`, `audit tree`, and
-`audit verify-chain` require the `OperationalAudit` permission; `audit export`
+`audit verify-chain` and `audit archive list|verify` require the `OperationalAudit`
+permission; `audit export`
 additionally requires `AuditExport`; `audit backfill-source-node` requires the
 `Admin` role (maintenance path only). The server enforces permission checks and
 returns HTTP 403 (CLI exit code 2) on denial.
@@ -315,6 +316,8 @@ scadabridge audit export --since <t> --until <t> --format csv|jsonl|parquet --ou
 scadabridge audit tree --execution-id <guid> [--format table|json]
 scadabridge audit backfill-source-node --before <ISO-8601-UTC> [--sentinel <value>] [--batch <n>]
 scadabridge audit verify-chain --month <YYYY-MM>
+scadabridge audit archive list
+scadabridge audit archive verify --name <archive>
 ```
 
 - `audit query` — filtered query against the central `AuditLog` table, matching the
@@ -323,8 +326,9 @@ scadabridge audit verify-chain --month <YYYY-MM>
   JSON (default) or table.
 - `audit export` — server-side streaming export of the central `AuditLog` to the
   requested format (`csv`, `jsonl`, `parquet`) written to `--output`. The server
-  streams rows rather than materializing them in memory; the CLI writes bytes
-  through to disk. Supports the same scoping filters as `audit query`.
+  streams rows rather than materializing them in memory (Parquet: one row group of
+  10,000 rows at a time, the same 24 columns as csv/jsonl — ScadaBridge#42); the CLI
+  writes bytes through to disk. Supports the same scoping filters as `audit query`.
 - `audit tree --execution-id <guid>` (M5.3 T8) — renders the full execution-chain
   tree for the given `ExecutionId`. The server resolves the root from any node in
   the chain (walks `ParentExecutionId` to find the root, then traverses downward)
@@ -346,6 +350,13 @@ scadabridge audit verify-chain --month <YYYY-MM>
   `0` intact or not chained, `3` broken, `1` error, `2` authorization failure. Requires
   `OperationalAudit` and a caller not scoped to specific sites. See
   Component-AuditLog.md, Security & Tamper-Evidence.
+- `audit archive list` / `audit archive verify --name <archive>` (ScadaBridge#42) —
+  send the `ListAuditArchives` / `VerifyAuditArchive` management commands for the
+  AuditLog Parquet cold archives the retention purge writes (`AuditLog:Archive`,
+  default off). `verify` checks the files against their manifest, recomputes the
+  archived hash chain and compares its end with the purge anchor; exit `0` verified,
+  `3` not verified, `1` error, `2` authorization failure. Same gate as `verify-chain`.
+  See Component-AuditLog.md, Retention & Purge.
 
 ### Health Commands
 ```