ToArchiveOperation/ToUnarchiveOperation rebuilt the operation document from
the in-memory progress state, which does not carry InitiatedById/
InitiatedByName/OperationId, and MessageArchiver stored that stripped copy
over the original after every batch. A restart mid-operation then resumed
with no attribution and silently skipped the per-message audit entries of
all remaining batches — the exact scenario the persisted fields exist for.

The attribution is now passed into the mapping explicitly so no call site
can drop it, and tests snapshot the persisted document after the first
batch (the state a restart resumes from) for both archive and unarchive.

Also fixes an IDE0055 formatting error in EditHandlerAuditTests that broke
the ServiceControl.Persistence.Tests.RavenDB build.

PendingRetriesHandler emitted per-message retry entries when it resolved
the ids and then sent RetryMessagesById without the audit headers. That
recorded messages as retried that might never be staged (e.g. claimed by a
concurrent batch), and severed the attribution chain so the staged batch
carried no OperationId — the execution-time entries every other retry path
emits were never produced.

The handler no longer audits (and no longer needs the audit log); it
re-stamps the audit headers on the follow-up command so the batch carries
the attribution and RetryProcessor emits the per-message entries when the
messages are actually staged, like all other retry paths.

Also corrects the stale comments on RetryBatch.OperationId and
AuditStagedMessages claiming single/explicit-id retries leave OperationId
null — every path threads it; only legacy unstamped commands are null.

A retry forwarded to a remote instance (instance_id routing) is audited on
the remote under the remote's TraceIdentifier, and YARP copies that
Request-Id back onto the response — but the middleware's OnStarting callback
overwrote it with the local proxy's TraceIdentifier, handing the caller an
operation id that no audit entry on any instance matches. The header is now
set only when absent.

The identical middleware was pasted into all three instances; it now lives
once in ServiceControl.Hosting (UseRequestIdHeader) next to the other
cross-instance pipeline extensions, and the header name constant replaces
the magic string in the three CORS exposed-header lists.

The group archive/unarchive/retry controllers emitted the success operation
entry before the IsOperationInProgressFor guard, so a request ignored as a
no-op (operation already running, double-click) was still recorded as a
successful operation attributed to the caller — with an operation id that
never gains any per-message entries. The audit entry is now emitted inside
the guard, next to the work it describes.

Every controller wrote the operation entry with the implicit success
outcome before performing the send, so a transport failure returned HTTP
500 with nothing enqueued while the trail already claimed success — and
the failure outcome was dead code no production path could ever emit.

Controllers now run the action through AuditedOperation, which executes
the send and records the entry afterwards with the actual outcome
(failure + rethrow when the send throws). The stamped local SendOptions
ritual repeated at every call site is collapsed into
AuditHeaders.LocalSendOptions.

The per-message edit entry was emitted right after the failed message was
marked resolved but before the edited message was dispatched, so a
dispatch failure (transport down) left a success entry for an edit whose
message never went anywhere — repeated on every redelivery. The entry is
now emitted after the dispatch, so each audit entry corresponds to an
actual dispatch of the edited message.

A batch archive fans out into one ArchiveMessage command per id, and the
handler hardcoded scope 'single' on the per-message entries while the
operation entry said 'batch' — the only path where per-message scope did
not match the originating operation (unarchive batch/range, group and
retry paths all propagate it). The command now carries the operation's
scope; the default (Single) keeps legacy in-flight commands and the
single-archive endpoint correct.

The test archived group B and immediately unarchived it, but
UnarchiveDocumentManager.GetGroupDetails reads ArchivedGroupsViewIndex,
which is async — on a slow runner the index hadn't seen the archive yet,
so the unarchive logged 'No messages to unarchive' and no-opped, message B
expired along with A, and the wait for exactly one remaining message timed
out (observed on Linux-PrimaryRavenPersistence; Windows passed).

Wait for indexing between the archive and the unarchive, like the test
already does after ingestion.

MessageAction/Operation built the full ECS JSON document (timestamp
formatting, anonymous object graph, reflection-based serialization) before
the source-generated log method's internal IsEnabled check — wasted work
for every message of a bulk retry/archive when the operator filters the
high-volume ServiceControl.Audit.Messages category, which the class
explicitly supports. The level check now runs first.

Also shares the single EcsJsonOptions with AuthorizationAuditLog (the PR
already had to retrofit WhenWritingNull onto one copy to keep the two
streams consistent) and replaces the per-entry scope
ToString().ToLowerInvariant() with constant names.

Tests pin the contracts these changes could break: per-outcome level
semantics under a Warning category filter, and the exact lowercase scope
mapping for every MessageActionScope value.