fix(cli): route bee run scenarios through App so blackbox mirrors them

`bee run <scenario>` called platform.System.RunScenario directly with an
empty base dir, which defaults to /var/log/bee-sat — a tree the blackbox
worker does not mirror (it mirrors DefaultExportDir, /appdata/bee/export).
So a scenario launched from the CLI wrote its logs where blackbox never
looked: the sync-bracket hooks fired and flushed the export dir, but the
scenario's own output never reached the USB stick. The web-UI path was
unaffected because it goes through App.RunScenario, which defaults the base
dir to DefaultSATBaseDir (under the export dir).

Route the CLI through App.RunScenario too — matching the doc comment that
already claimed both paths did — so `bee run` output lands under the mirrored
export tree and shows up in the blackbox capture.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

audit/cmd/bee/main.go

@@ -540,13 +540,18 @@ func runScenario(args []string, stdout, stderr io.Writer) int {
 		return 1
 	}
 
-	// Wires the same blackbox kick/sync-bracket hooks the SAT job runner
+	// Run through the App (not sys.RunScenario directly) for two reasons:
-	// uses (see app.New()), so a scenario command job's evidence reaches
+	// it wires the same blackbox kick/sync-bracket hooks the SAT job runner
-	// removable media the same way a SAT job's does.
+	// uses (see app.New()), AND App.RunScenario defaults the base dir to
-	_ = app.New(sys)
+	// DefaultSATBaseDir (under DefaultExportDir) — the tree the blackbox
+	// worker actually mirrors to removable media. Calling sys.RunScenario
+	// with an empty base dir would write to /var/log/bee-sat instead, which
+	// blackbox does not mirror, so a `bee run` scenario would never reach the
+	// USB stick even with the hooks firing.
+	a := app.New(sys)
 
 	logLine := func(s string) { fmt.Fprintln(stderr, s) }
-	runDir, err := sys.RunScenario(context.Background(), "", spec, logLine)
+	runDir, err := a.RunScenario(context.Background(), "", spec, logLine)
 	if err != nil {
 		fmt.Fprintf(stderr, "bee run: %v\n", err)
 		return 1