docs: document the tenant:ai:audit export and archive commands

Wave 4 registered `tenant:ai:audit:export` and `tenant:ai:audit:archive`
but never added them to the CLI reference, which the commands-documented
integrity spec enforces. Add both rows so every registered ace command is
documented.

Author: Arcoders

docs/reference/commands.md

@@ -246,6 +246,8 @@ Available when `--with=ai` is configured. Full reference in the
 | Command | What it does |
 |---|---|
 | `tenant:ai:audit:verify` | Re-walk the append-only AI audit hash chain and report the first tamper (a broken checksum, a `seq` gap, or a broken prev-link) that got past the DB triggers. Exit 1 on the first break, so it gates a cron or a post-incident check. Flags: `--tenant=<id>` (omit for all), `--json`. |
+| `tenant:ai:audit:export` | Export the append-only AI audit chain as NDJSON or CSV in `(tenant_id, seq)` order so an external tool can re-verify it offline (it recomputes each checksum and links through the exported `prevChecksum`, needing nothing live). Flags: `--tenant=<uuid>` (omit for all), `--from` / `--to` (ISO 8601 bounds on `occurred_at`), `--format=ndjson\|csv`, `--out=<file>` (defaults to stdout). Fail-closed: a write error destroys the partial file and exits non-zero. |
+| `tenant:ai:audit:archive` | Archive a tenant's AI audit segment: verify the chain, export it to a WORM/SIEM destination in chain order, then advance a signed checkpoint. It prunes nothing, since detaching live rows is deliberately not wired here. Flags: `--tenant=<uuid>` (required, the checkpoint is per-tenant), `--from` / `--to` (ISO 8601 bounds), `--format=ndjson\|csv`, `--out=<file>` (required). Fail-closed: the checkpoint advances only after the export succeeds and the chain verifies. |
 | `tenant:ai:purge` | Erase a tenant's AI data for GDPR: conversation memory, the response-cache epoch, and embeddings. Scopes: `--tenant=<uuid> --force` (all), `--tenant=<uuid> --principal=<id>` (one user, Art.17), `--tenant=<uuid> --source=<key>` (one document). `--dry-run` previews the counts and writes nothing; `--verify-chain` also re-walks the audit chain; `--actor=<id>` sets the audited operator. The immutable, non-PII audit chain intentionally survives. |
 
 ## Crypto