feat(cost): roll up coverage-aware OpenCost snapshots

[gnanirahulnutakki]

Summary

• preserve successful-empty OpenCost projections as explicit per-scope reporting snapshots
• aggregate all component and total USD values with exact decimal arithmetic for one workspace and window
• expose sorted expected, reported, successful-empty, and missing coverage so partial data cannot look complete
• revalidate fact taxonomy, identity, provenance, canonical payload, native identity, and fixed resource bounds before returning any result

Trust, security, and cost boundary

• the expected-scope set and successful-snapshot presence remain trusted caller claims; complete is relative to that declared set
• invalid, duplicate, foreign, stale-marked, oversized, or ambiguous inputs fail atomically with no partial rollup
• output retains aggregate amounts and authorized cluster coverage only; namespace and raw OpenCost metadata do not survive
• no network client, endpoint discovery, credentials, persistence, runtime wiring, mutation, or execution capability is added
• no cloud resource, API call, storage, egress, logging-volume, or recurring-service cost is introduced

Verification

• full local CI: formatting, vet, zero lint issues, no reachable vulnerabilities, race tests, policy tests, Prometheus rules, performance, end-to-end tests, and production build
• PostgreSQL forced-RLS isolation plus two 50,000-execution cross-workspace fuzz campaigns
• reproducible four-platform release, SPDX SBOMs, checksums, Homebrew metadata, and multi-platform OCI validation
• pinned Kubernetes 1.36.1 kind suite passed in 238.257 seconds
• OpenCost projection and rollup fuzz boundaries each passed 50,000 generated executions
• two zero-finding CodeRabbit reviews after one minor ADR wording correction
• high-signal credential scan clean; GitHub security queues 0 Dependabot / 0 code scanning / 0 secret scanning
• signed ED25519 head with DCO and GSTACK checkpoint

Documentation

• README and mirrored E13 roadmap updated
• ADR 0012 records the decision, alternatives, bounds, primary sources, and nonclaims
• GSTACK session journal captures the implementation and proof trail

Closes #284
Progresses #31

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ab0a2e58-8c57-4cf8-b032-5c9364530e64

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/feat/e13-opencost-workspace-rollup

---

_{Comment @coderabbitai help to get the list of available commands.}