F13.2a: Roll up validated OpenCost snapshots with explicit coverage

[gnanirahulnutakki]

Parent: #31
Depends on: #282

Goal

Build the first honest F13.2 slice: turn validated, already-authorized per-cluster OpenCost
namespace-cost snapshots for one exact UTC window into one deterministic workspace USD rollup with
explicit coverage.

This is a bounded offline computation seam. It preserves a successful empty allocation result as
reported coverage and distinguishes it from a missing cluster. It performs no discovery, network
access, credential loading, persistence, team attribution, UI rendering, billing, optimization, or
mutation.

Acceptance criteria

• Add a coverage-preserving namespace-cost snapshot result that binds workspace, cluster scope,
  exact UTC window, trusted USD unit, and the deterministic facts from F13.1a: Project bounded OpenCost namespace allocations into cost facts #282.
• Keep the existing projector API compatible while ensuring a successful empty allocation map
  remains distinguishable from a missing scope.
• Add a bounded workspace rollup over an explicit, unique expected-scope set and zero or one
  successful snapshot per reporting scope.
• Require every snapshot and fact to match the requested workspace, scope, exact window,
  currency, OpenCost provenance, namespace identity, telemetry lens, and canonical closed
  payload; fail atomically on ambiguity or duplication.
• Sum every normalized cost component and total with exact decimal arithmetic and emit
  canonical five-decimal USD strings in deterministic output.
• Surface expected, reported, empty, and missing scopes explicitly; never infer a fact or zero
  cost for a missing scope and never call partial coverage complete.
• Preserve the allocation-window end as the rollup observation time without selecting a stale
  threshold or refreshing historical evidence at collection time.
• Bound expected scopes, snapshots, facts, identities, input bytes, output bytes, and decimal
  magnitude; retain no raw source metadata.
• Add table, boundary, determinism, no-partial-result, privacy, and fuzz tests covering malformed
  and adversarial snapshots plus successful-empty and partial-coverage cases.
• Update README, mirrored E13 roadmap text, ADR index/decision, and the GSTACK session trail.

Non-goals

• No OpenCost HTTP client, port-forward, Service/Ingress discovery, Kubernetes Service proxy,
  endpoint, TLS, authentication, credential, or OCM transport.
• No database/runtime wiring or background collection.
• No per-team or label grouping; the repo has no canonical team-attribution contract yet.
• No UI/API surface, freshness objective, stale classification, currency conversion, billing,
  metering, recommendations, optimization, GPU efficiency/DCGM/MIG inference, write, or execution.

Security, operability, and cost

• Revalidate all normalized facts before aggregation and return no partial rollup on invalid input.
• Never copy labels, annotations, provider IDs, workload identity, endpoints, credentials, or
  unknown fields into the rollup.
• Runtime cost is bounded local CPU and memory only; no cloud resource, API, storage, network,
  telemetry-volume, or egress spend is introduced.

Exit proof

• Focused race tests and fixed-execution adversarial fuzz campaigns pass.
• Repository formatting, lint, vet, unit/race, integration, release, isolation, and relevant real
  Kubernetes gates pass.
• Manual red-team review and CodeRabbit report no unresolved actionable finding.
• Exact-head CI/CodeQL and hosted review pass before merge; exact post-merge dev CI/CodeQL and
  final 0/0/0 security queues pass before closeout.

[gnanirahulnutakki]

Landed through #285 as merge commit f3e00f4.

Closeout proof:

• exact base 3d45529 and locally verified signed ED25519 DCO/GSTACK head f88dc05
• exact-head CI 29672331770 and CodeQL 29672330956 succeeded
• hosted CodeRabbit completed with 0 total and 0 unresolved review threads
• GitHub-verified merge commit preserves prior dev and the signed feature head as its exact parents
• exact post-merge dev CI 29672650029 and CodeQL 29672649903 succeeded on f3e00f4
• final security queues: 0 Dependabot, 0 code-scanning, and 0 secret-scanning alerts
• all acceptance criteria are checked; README, mirrored roadmap, ADR 0012, GSTACK, Notion, and EXTENDED Obsidian checkpoints are current

This closes only bounded offline F13.2a. Parent #31 remains open: the live F13.1 transport, runtime composition, team attribution, F13.3, and F13.4 are not completed or implied.