Rationalize default configuration file paths and update documentation

docs/architecture/architecture.md

@@ -198,7 +198,7 @@ audita config print-effective [--config <config.yml>]
 Current runtime flow (`internal/cli/run.go`):
 1. Build runtime config from:
    - defaults;
-   - file config source (`--config`, `AUDITA_CONFIG`, or `/etc/audita/config.yml` when present);
+   - file config source (`--config`, `AUDITA_CONFIG`, or default search paths when present: `/usr/local/etc/audita/config.yml`, then `/etc/audita/config.yml`);
    - environment overrides;
    - CLI overrides.
 2. Parse flags and apply CLI overrides.
@@ -304,9 +304,9 @@ File-config source behavior:
   - required to exist, otherwise process fails clearly.
 - `AUDITA_CONFIG` (when `--config` is not provided):
   - required to exist, otherwise process fails clearly.
-- default path `/etc/audita/config.yml` (when neither explicit source is provided):
-  - used only when present;
-  - silently ignored when missing.
+- default paths `/usr/local/etc/audita/config.yml`, then `/etc/audita/config.yml` (when neither explicit source is provided):
+  - first existing path in that order is used;
+  - both missing is silently ignored.
 
 Versioned file-config behavior (`internal/core/config/file_config.go`):
 - supported version: `version: 1`;

docs/architecture/public-contract.md

@@ -54,7 +54,7 @@ Precedence for `audita process`:
 Config source behavior:
 - `--config <path>`: missing path is a clear failure
 - `AUDITA_CONFIG`: missing path is a clear failure
-- default `/etc/audita/config.yml`: missing file is non-fatal
+- defaults `/usr/local/etc/audita/config.yml`, then `/etc/audita/config.yml`: both missing is non-fatal
 
 ## Supported transcript input forms
 

docs/configuration.md

@@ -26,13 +26,14 @@ For `audita process`, config path resolution is:
 
 1. `--config <path>` if provided
 2. `AUDITA_CONFIG` if set and `--config` is not provided
-3. default `/etc/audita/config.yml` if present
+3. default `/usr/local/etc/audita/config.yml` if present
+4. fallback default `/etc/audita/config.yml` if present
 
 Missing-file behavior:
 
 - missing `--config` path: hard failure;
 - missing `AUDITA_CONFIG` path: hard failure;
-- missing `/etc/audita/config.yml`: non-fatal, run continues.
+- missing both default-path files: non-fatal, run continues.
 
 ## Precedence model
 

docs/release-checklist.md

@@ -16,7 +16,9 @@ Use this checklist before cutting a pre-1.0 or 1.0 release candidate.
   - `audita config print-effective --config <path>`
 - Confirm precedence behavior:
   - defaults -> file config -> environment -> CLI.
-- Confirm missing `/etc/audita/config.yml` is non-fatal when `--config`/`AUDITA_CONFIG` are unset.
+- Confirm default config search order:
+  - `/usr/local/etc/audita/config.yml` first, then `/etc/audita/config.yml`.
+- Confirm missing both default-path config files is non-fatal when `--config`/`AUDITA_CONFIG` are unset.
 
 ## Output schema checks