feat: add karmor simulate — policy dry-run / impact simulation mode

## Feature Request **Short Description** Add a `karmor simulate` command that replays buffered telemetry events against a given policy YAML in pure userspace — showing which events *would* be blocked or allowed — without touching cluster enforcement state. **Is your feature request related to a problem? Please describe the use case.** Applying a new `KubeArmorPolicy` is currently a blind operation. The only safety valve is switching `action` to `Audit`, waiting for real traffic, manually reviewing logs, then switching to `Block`. There is no way to preview the blast radius of a policy against already-observed telemetry before enforcing it. This leads to accidental workload breakage in production clusters. **Describe the solution you'd like** Add a `karmor simulate` subcommand to `kubearmor-client`: ```bash karmor simulate --policy my-policy.yaml --namespace default --last 30m karmor simulate --policy my-policy.yaml --pod myapp-6d4b8-xxx --last 1h --output json ``` Expected output: Simulating policy: block-shell-access Matched 23 events in the last 30m (namespace: default) WOULD BLOCK /bin/bash [pid=1482, pod=api-74x, container=api] WOULD BLOCK /bin/sh [pid=2091, pod=api-74x, container=api] ALLOWED /usr/bin/curl [pid=3012, pod=api-74x] Summary: 2 events would be blocked, 21 would be allowed. **Implementation Plan** - Phase 1: Add `simulate` cobra subcommand; parse `--policy`, `--namespace`, `--pod`, `--last`, `--output` flags - Phase 2: Reuse relay gRPC fetch logic (already in `karmor logs`) to collect telemetry for the time window - Phase 3: Implement a pure-Go policy matcher evaluating `matchPaths`, `matchDirectories`, `matchPatterns` against each event - Phase 4: Render human-readable table + aggregate stats; support `--output json` for CI pipelines **Describe alternatives you've considered** The existing `Audit` action partially helps but requires live traffic, real time, and modifies the policy enforcement state. The proposed approach is entirely stateless and safe to run against production clusters. **Additional context** I would like to work on this as part of the LFX mentorship program. Happy to share a design doc for maintainer review before starting implementation.