canonical/auditd-operator ? reverse-engineered prompt

Build me a Juju charm that installs and manages Linux auditd on machines, with session recording turned on by default using tlog. It should work normally on bare metal or VMs, and still deploy on LXC containers, but in that case only do session recording and clearly block the unit if recording is turned off. I want it to wrap SSH logins so interactive sessions and remote commands get recorded to a log file, with a way to exclude specific Unix groups from recording. Please include the audit rules and checks needed to help detect tampering with the recording setup, plus Loki alert rules for suspicious interactive changes. Make sure it can be configured cleanly from Juju, and that there is a straightforward way to replay recorded sessions later. If you need to check current Juju or tlog docs while wiring it up, go ahead and look them up.