feat(export): add JSONL_FLAT export format (HYBIM-788)

[etserend]

Summary

• Ports upstream commit 6ccd06a from rungalileo/galileo-python (PR #621)
• Adds JSONL_FLAT = "jsonl_flat" to LLMExportFormat enum
• Extends ExportClient.records() decode path to treat JSONL_FLAT identically to JSONL
• Adds jsonl_flat value to openapi.yaml LLMExportFormat schema

Stacked on: #73 (feat/HYBIM-788-port-e42a569 — include_code_metric_metadata)

Test plan

• poetry run pytest tests/test_export.py -v — 18 passed
• test_export_records_jsonl_flat — new test verifying JSONL_FLAT decodes records correctly and sets export_format on request body
• ruff check src/splunk_ao/ — clean
• No stray from galileo. imports in src/splunk_ao/

🤖 Generated with Claude Code

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: approve — Minimal, correct JSONL_FLAT port with matching enum/schema/decode changes and a targeted test.

[fercor-cisco]

Port verification: faithful ✅

Compared this PR's port commit (`1e42f6a`) against upstream `6ccd06a` (rungalileo/galileo-python PR #621). Nothing from upstream is left out.

Upstream touches 4 files, all ported 1:1:

Upstream file	Change	Ported?
`openapi.yaml`	add `jsonl_flat` to LLMExportFormat enum	✅ identical
`src/galileo/export.py`	`== JSONL` → `in (JSONL, JSONL_FLAT)`	✅ identical (→ `src/splunk_ao/export.py`)
`.../models/llm_export_format.py`	add `JSONL_FLAT = "jsonl_flat"`	✅ identical
`tests/test_export.py`	add `test_export_records_jsonl_flat`	✅ ported

Note: the extra files visible in the PR diff-against-`main` (`log_records_export_request.py` + the two `include_code_metric_metadata` tests) belong to the other stacked commit `10b2fb4` (porting `e42a569`), and are correctly out of scope for this port.

Only deviation (cosmetic, not a loss)

In the ported test, `root_type` was changed from upstream's `RootType.SESSION` to `RootType.TRACE`. Both are valid enum values, and `root_type` is irrelevant to what this test asserts (JSONL_FLAT decoding + `export_format` on the request body). Harmless — but matching upstream would minimize port drift.

Verdict: every enum value, the decode-path change, the OpenAPI schema entry, and the test are all present and behaviorally equivalent. The only differences are the expected `galileo` → `splunk_ao` rename and the trivial `RootType` swap. No functionality lost.

🤖 Generated with Claude Code