fix(metrics): count orphaned-workflow governance incidents in the window rollup

[sturlese]

Bug

The window governance counters and the all-time counters disagreed for a workflow that had been deleted/renamed in config while its historical runs remained in the store. For an in-window budget block on such an orphaned workflow_id:

• governance.blocked_budget (window) = 0
• governance.blocked_budget_all = 1

The _all counters are documented as a superset ("since the beginning, so old incidents stay visible"), so the window counter reading 0 while _all reads 1 for an incident that is in the window is internally inconsistent and understates the window's governance posture.

Root cause

The window counters (blocked_budget / blocked_policy / failed) are incremented inside the for workflow_id, workflow in org.workflows.items() loop, so a run whose workflow_id isn't a current workflow is never seen. The _all counters are tallied in a per-run pass with no workflow lookup, so they include orphaned runs.

Fix

After the per-workflow loop, a small pass over the window runs whose workflow_id is absent from the config classifies their blocks/failures the same way (budget vs policy, and failed). Runs of known workflows were already tallied in the loop above, so the pass is disjoint — no double counting.

Because every run in a normal org belongs to a current workflow, this changes nothing for existing orgs (verified: the full suite and the deterministic demo are unaffected); it only surfaces incidents that were previously dropped.

Test

test_window_governance_counts_orphaned_workflow_incidents: seeds a budget block, a policy block, and a failed run for a deleted-wf in the window, then asserts each window counter now equals its all-time counterpart. Fails on main (window=0, all=1), passes with the fix.

Full suite: 177 passed, 92.74% coverage (gate 85%); ruff clean; offline flightdeck demo + audit verify intact.

Found by an autonomous bughunt iteration.

[sturlese]

bughunt gate — /code-review high ✅ clean

Reviewed across 8 angles — no findings. The new pass is disjoint from the per-workflow loop (known vs. unknown workflow_id — no double count) and purely additive (a no-op for any org whose runs all belong to current workflows, so existing numbers and the deterministic demo are unchanged — 177-pass suite confirms). The budget/policy/failed classification mirrors the two existing sites, restoring the documented _all ⊇ window superset relationship. The classification triplication matches the codebase's pre-existing pattern; extracting a helper would exceed this fix's scope. Regression test fails on main (window=0, all=1), passes with the fix. Full local gate: 177 passed, 92.74% coverage, ruff clean, demo intact. Full mode: watching CI to merge on green.