feat: unified event timeline across MCP Gateway, AWF firewall, and agent logs (#34782)

* wip: start unified timeline implementation

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* wip: plan unified timeline with agent events + JS + Go rendering surfaces

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* feat: unified event timeline for MCP Gateway, AWF firewall, and agent logs

- Add TimelineSourceAgent + agent event kinds (agent_turn, agent_tool_start,
  agent_tool_done) to gateway_logs_timeline.go
- Add parseEventsJSONL helper and collectAgentTimelineEvents in same file
- Update BuildUnifiedTimeline to include agent events from events.jsonl
- Add rendering primitives for agent events in gateway_logs_timeline_render.go
  (renderAgentTurnRow, renderAgentToolStartRow, renderAgentToolDoneRow)
- Update renderUnifiedTimeline summary to show AG counts
- Wire renderAuditUnifiedTimeline into audit.go (Go audit log generation surface)
- Wire displayUnifiedTimeline into logs_orchestrator.go (Go logs CLI surface)
- Create actions/setup/js/unified_timeline.cjs: JS parser + renderer for
  GITHUB_STEP_SUMMARY (all three sources, sorted merge, Markdown <details> table)
- Create actions/setup/js/unified_timeline.test.cjs: 66 Vitest tests
- Integrate generateUnifiedTimelineSummary into writeStepSummaryWithTokenUsage
  in parse_mcp_gateway_log.cjs so timeline is appended to every step summary
- Create pkg/cli/gateway_logs_timeline_test.go: Go unit tests for all surfaces

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* fix: address code review issues from parallel_validation

- Guard timelineSourceLabel default case against short strings (Go + JS)
- Deduplicate sorted-order check in displayUnifiedTimeline (calls
  sortUnifiedTimelineEvents once instead of inline-checking then calling)
- Fix sortUnifiedTimelineEvents comment to reflect sort.SliceStable usage;
  inline the sort and remove now-unused sortEventsStable helper
- Use truncate() helper for firewall detail in unified_timeline.cjs for
  consistent ellipsis handling with other collectors
- Fix test assertion: replace buggy regex with plain string check for pipe
  escaping in buildUnifiedTimelineMarkdown

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* docs(adr): add draft ADR-34782 for unified event timeline

* Update; rm -rf /

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* fix: address PR review comments - JS firewall filters, Go header, lock file revert

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* fix: simplify JS url field lookup to use lowercase json tag

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>

Author: 3 people

actions/setup/js/parse_mcp_gateway_log.cjs

@@ -6,6 +6,7 @@ const { getErrorMessage } = require("./error_helpers.cjs");
 const { displayDirectories } = require("./display_file_helpers.cjs");
 const { ERR_PARSE, ERR_SYSTEM } = require("./error_codes.cjs");
 const { computeEffectiveTokens, getTokenClassWeights, formatET } = require("./effective_tokens.cjs");
+const { generateUnifiedTimelineSummary } = require("./unified_timeline.cjs");
 
 /**
  * Parses MCP gateway logs and creates a step summary
@@ -207,6 +208,16 @@ function writeStepSummaryWithTokenUsage(coreObj) {
       }
     }
   }
+
+  // Append the unified event timeline (gateway + firewall audit + agent events)
+  // to the step summary immediately before flushing, so it appears as the last
+  // section regardless of which gateway log format was detected above.
+  const timelineMd = generateUnifiedTimelineSummary();
+  if (timelineMd) {
+    coreObj.info(`Appending unified event timeline to step summary`);
+    coreObj.summary.addRaw(timelineMd);
+  }
+
   coreObj.summary.write();
 }