p95 went from 190 ms to 405 ms between 13:50 and 14:10, all of it in GET /v1/audit-events. The 3.4 audit log export tripled read volume on events, and events_workspace_created_idx from Monday was built on primary but never on the eu-west replica. The planner there is sequential scanning 94 GB per request.

Yes with concurrently, which takes no write lock. It ran 34 minutes on primary, so expect similar on the replica, and replication lag will climb while it builds. The safer order is to pause the export job first, then build.