feat: add observability ingest edge guardrails

[shaomingbo]

What changed

• add an auditable observability ingest edge guardrails runbook covering exact parameters, product semantics, official pricing formulas, four-state drift handling, and future rollout approval/change/verify/rollback gates
• add a strictly read-only precheck with offline fixture mode, field-level drift evidence, deterministic 0/1/3 exit codes, strict sanitized-evidence schemas, and sensitive-output redaction
• add fixtures and regression tests for every critical Cloud Armor, backend, Cloud Run, budget, permission, freshness, boolean-type, read-only allowlist, and redaction path
• link the guardrails and future rollout ownership from docs/DEPLOY.md and wire the tests into scripts/verify.sh

Why

The ingest edge controls need a reviewable Ops safety gate before any production rollout. This PR makes parameters, capabilities, cost calculations, current-state drift, approvals, and rollback expectations independently auditable without changing GCP or production state.

Impact and safety boundary

• documentation, scripts, fixtures/tests, and verify wiring only
• no production Go code, wire schema, migrations, or deployment configuration changes
• no GCP resource writes, production data-plane requests, cost approval, feature-flag changes, or deployment
• all mutating examples are explicitly marked ROLLOUT-ONLY

Review repair round 1

• define sanitized tier and budget evidence as a same-run, read-only current-state observation rather than values copied from target or approval material
• encode observation presence separately from values so confirmed absence/drift exits 1 while missing or malformed observation evidence exits 3
• add real-mode regression coverage for tier drift/absence, budget drift/absence, and missing observation evidence
• make fixture mode without python3 return the documented sanitized exit code 3 instead of shell exit 127

Validation

• scripts/verify.sh passed on commit 7e88f536b1a07303e9c7cf550a9c5cc9044e268e
  • gofmt, go vet, all Go tests
  • observability ingest edge precheck tests
  • dependency direction and sqlc drift checks
  • migration gate skipped per repository behavior because TEST_DATABASE_URL was unset
• focused shell syntax, edge precheck, and git diff --check gates passed
• fresh reviewer covered the 3/3 repair paths with no blocking findings
• security/privacy cross-review raised source provenance binding as a scope concern: cryptographically or directly binding sanitized evidence to billing control-plane state would require either reading forbidden billing-account coordinates or introducing a new attestation trust mechanism; this is recorded for explicit follow-up rather than silently expanding this PR

Review notes

Non-blocking backlog remains: narrow Cloud Run annotation projection, add direct real-mode shadowing-normalizer coverage, and make the static gcloud allowlist detect every service family. String-typed Cloud Armor priority handling remains theoretical because the API schema emits an integer.

[shaomingbo]

[round-tracker] round=1, 本轮净增 69, 累计净增 69, verdict=PASS_WITH_UPGRADE

本轮固定范围：c6b77fe457d0d862c46762aedc04604c7de1dc5a..7e88f536b1a07303e9c7cf550a9c5cc9044e268e，tree d1b157d9a2fb91b19c6989373a3350d35fc1cac8。

三分法处置

• 已修 P2：sanitized tier/budget evidence 改为同轮只读当前状态观测；显式区分 present 与实际值。tier drift/absent、budget threshold drift/absent 均字段级 DRIFT、exit 1；缺失/畸形 observation exit 3。文档明确禁止从目标值或批准材料反向填充。
• 已修 P3：fixture mode 缺 python3 时输出 INPUT-UNAVAILABLE: python3 is unavailable 并 exit 3，不再返回 127。
• 升级待拍板：cross-reviewer 要求对 sanitized observation 做可验证来源绑定。直接读取 budget 控制面需要 billing account ID，违反本 PR 的敏感信息边界；签名/attestation 会引入新的信任不变量。当前按 Review 指定的“人在回路只读观察后脱敏”边界收口，来源绑定留待独立设计。
• BACKLOG 保留：收窄 Cloud Run annotation 投影；增加 real-mode shadowing normalizer 集成用例；静态 gcloud allowlist 覆盖所有服务族。

验证与审查

• 聚焦 shell syntax、edge precheck tests、git diff --check：通过。
• 完整 scripts/verify.sh：通过；migration gate 因未设置 TEST_DATABASE_URL 按仓库规则跳过。
• fresh reviewer：3/3 repair paths，accept，无阻断。
• security/privacy cross-reviewer：提出上述来源绑定 scope concern；主线程按升级通道裁决，不触发 repair。
• repair round：0/2（初始实现不计 repair）；PR 累计大轮次：1/3。
• 最终本地 HEAD、远端 PR head、已验证候选一致；工作树干净。

未执行 merge、release、deployment 或任何 GCP/生产操作。

[shaomingbo]

[round-tracker] round=2, 本轮净增 10, 累计净增 79, verdict=PASS_WITH_UPGRADE

本轮固定范围：7e88f536b1a07303e9c7cf550a9c5cc9044e268e..8976266f2caf8eda91b302dbae28d301f466c139，tree 39f9b5092e0ba3e46232d8b0d9a6bd01983f9e51。

三分法处置

• 已修：补 real-mode higher-priority shadowing normalizer 集成用例；原始 policy JSON 含 enforced priority 900 时，真实归一化路径输出字段级 DRIFT 并 exit 1。
• 已修：静态 gcloud allowlist 改为逐行精确 inventory；每条非注释 gcloud 引用都必须与已知 4 条只读调用及明确非调用引用逐行一致，其他 service family、命令位置、同一行追加和零净计数替换均失败。
• 已反驳 / P3 BACKLOG：Cloud Run annotation 投影进一步收窄未构成当前 AC/公开契约违约，本轮测试修复不扩面；保留 backlog。
• 已升级待拍板：sanitized observation 来源绑定需要新的 attestation/信任不变量；直接读取 budget 控制面需要 billing account ID，与 NFR4/deferred 冲突。已通电路径当前仍依赖人在回路同轮只读观察后脱敏，未通电的来源绑定机制留待独立设计。

自审与验证

• fresh reviewer 初审确认 shadowing 用例关闭，并发现 if gcloud ... 可绕过位置扫描；repair 1 后又发现总数门可被零净计数替换绕过；repair 2 改为精确 inventory。
• 最终 fresh reviewer：PASS，无已确认的锚定 P0-P2。
• repair round：2/2；PR 累计大轮次：2/3。本轮 diff 仅触及测试，未触发 cross-reviewer 条件。
• 聚焦 bash -n、edge precheck tests、git diff --check、两类绕过反例验证：通过。
• 完整 scripts/verify.sh：通过；gofmt、go vet、Go tests、edge precheck、dependency direction、sqlc drift 均通过；migration gate 因未设置 TEST_DATABASE_URL 按仓库规则显式跳过。
• go build ./...：通过。
• 本地 HEAD、远端分支、PR head 均为 8976266f2caf8eda91b302dbae28d301f466c139；工作树干净。
• 推送后 GitHub verify checks 已启动，评论时仍为 IN_PROGRESS，未把它们表述为已通过。

未执行 merge、release、deployment、GCP 操作或生产请求。