ELX-25: Observability — corpus-state snapshot, the remaining 2 signals

[cdevarenne]

Four of the six observability signals ship today: router decision, canonical hit/miss, refusal
rate, and per-path latency. All four fall out of one event per answered query.

The remaining two are a different shape. Concepts past stale_after and trust-tier
distribution are not about a query at all — they are a scan over knowledge/ describing the
bundle's governance state at a moment, on a much slower cadence. That is why they were split
out rather than padded into the per-query slice.

A time series of these snapshots is what turns "is governance keeping up?" into a line on a
chart, and it is also what closes the staleness early-warning gap.

Done when

• gctx telemetry snapshot scans knowledge/ and prints locally, with no cluster
• --as-of time-travels, so a governance cliff is visible before it arrives
• staleness and trust tier are derived by the same code the deterministic lookup uses —
  a snapshot that disagreed with lookup() about a concept would mean one of them is wrong
• aggregates plus a bounded list of stale ids, never a per-concept dump: the instrument
  built to answer "does curation scale?" must not itself scale with the corpus
• projected into its own index, with Kibana panels over the time series

Contract: docs/specs/observability-corpus-state.md.

[cdevarenne]

Note on the deferral, so it does not outlive its premise.

This was deferred with the reasoning that it "does not need the cluster live for the screen," and that the route-mix and canonical-miss panels already carry the does-curation-scale story. Both true, and both scoped to the interview window.

After the panel that reasoning expires. Two things then change:

1. ELX-30: Bundle maintenance runbook + staleness early warning #3 inherits the block. The staleness early warning depends on this snapshot, and ELX-30: Bundle maintenance runbook + staleness early warning #3 has just moved to P2 partly because a P1 cannot sit behind a P2. Once the panel is no longer the forcing function, the ordering between these two is the only thing left deciding when either gets built — this one goes first.
2. The 2026-09-09 cliff arrives. From 10 September every canonical fact is past stale_after, so a snapshot counting concepts past their date stops being a governance demo and starts being the thing that tells you what to re-verify.

No action now. Re-read the deferral reasoning rather than the deferral itself when picking this up.