Auto-fallback log Flex storage

[platinummonkey]

What does this PR do?

Adds automatic log storage selection for pup logs search and pup logs aggregate: omitted --storage now tries Flex first when safe and falls back to indexed logs when Flex is unavailable.

Motivation

PR #716 made Flex the hard default for log search and aggregate commands, which caused a negative customer impact for accounts that were not enabled for Flex. This keeps the Flex-first behavior for eligible accounts while preserving working defaults for customers that cannot use Flex yet.

Additional Notes

Changes:

• Removed the Clap flex default so omitted storage is distinguishable from explicit --storage flex.
• Added auto storage handling that tries Flex only when no explicit storage or index is supplied.
• Retries with indexed/default log storage on Flex-related 403 or Flex-specific 400 responses.
• Preserves explicit --storage flex failures without fallback.
• Updated log storage examples and LLM guide docs.
• Fixed the CI test mock ordering so fallback tests exercise the Flex 403 path before the broad fallback mock can match.
• Merged the latest main into the PR branch and resolved conflicts with the new logs patterns command tests.

Testing

• RUSTUP_TOOLCHAIN=stable-x86_64-unknown-linux-gnu cargo fmt --check
• git diff --check
• Added unit and mock tests for auto parsing, Flex-first search, Flex 403 fallback, explicit Flex no-fallback, and index-scoped auto behavior.
• Resolved merge conflicts in src/commands/logs.rs and src/test_commands.rs while keeping both the auto-storage tests and the new logs patterns tests from main.
• Attempted RUSTUP_TOOLCHAIN=stable-x86_64-unknown-linux-gnu cargo test logs --lib -- --nocapture, but it was blocked because Cargo could not fetch the pinned datadog-api-client-rust git dependency in this sandbox (GitHub returned 403 for the dependency fetch).
• Earlier cargo clippy --lib -- -D warnings was also blocked by the same dependency fetch issue.

Checklist

• The code change follows the project conventions (see CONTRIBUTING.md)
• Tests have been added/updated (if applicable)
• Documentation has been updated (if applicable)
• All CI checks pass
• Code coverage is maintained or improved

Related Issues

Follow-up to PR #716.

---

PR by Bits - View session in Datadog

Comment @DataDog to request changes

[datadog-datadog-prod-us1]

View session in Datadog

Bits Code status: ✅ Done

CI Auto-fix: Passed | Disable

Comment @DataDog to request changes

[datadog-datadog-prod-us1-2]

I can only run on private repositories.