fix(process): reject invalid temporal cohorts

[stacknil]

Summary

• fail closed when process and socket-link artifacts in one snapshot do not represent the same observation instant
• require the before instant to be strictly earlier than the after instant
• preserve up to microsecond UTC precision so valid captures within one second remain orderable
• reject finer timestamp precision instead of allowing Python datetime to truncate it silently
• document the temporal cohort, boot-local identity, and non-atomic collection boundaries

Why

build_diff_envelope() previously validated host and source only. It accepted reversed before/after snapshots and mismatched process/socket-link observation times, allowing a directional diff to be generated from an invalid temporal cohort.

Design decision

Compare timezone-aware instants rather than timestamp strings. Each snapshot requires process time == link time, followed by before < after. Snapshot normalization preserves up to six fractional-second digits while retaining the existing whole-second ...Z representation. Inputs with finer precision fail closed because datetime cannot represent their ordering without loss. Source envelope and telemetry adapter contract versions remain unchanged because the successful output shape is unchanged.

Main risk

Previously accepted equal, reversed, mismatched, or over-precision cohorts now return a CLI error. This is intentional fail-closed behavior, but consumers that relied on invalid ordering or nanosecond timestamps will need to correct capture provenance or quantize explicitly before ingestion. Matching timestamps still do not prove procfs and ss were collected atomically.

Compatibility impact

• existing whole-second golden artifacts and valid diff/report/adapter output remain byte-compatible
• equivalent timezone offsets compare as the same instant
• fractional snapshot inputs up to microseconds retain precision instead of being truncated
• inputs with more than six fractional-second digits are rejected
• invalid temporal cohorts fail before record comparison and produce no diff artifacts

Rollback path

Revert the behavior and documentation commits to restore v0.3 behavior; no data migration or schema downgrade is required. The test commits can remain as executable records of the rejected safety contracts or be reverted with the PR.

How to validate

cd projects/linux-auth-observe && python -m pytest -q        # 14 passed
cd projects/linux-socket-observe && python -m pytest -q      # 8 passed
cd projects/linux-permission-observe && python -m pytest -q  # 6 passed
cd projects/linux-process-observe && python -m pytest -q     # 30 passed
python -m compileall -q src tests                            # process lab

The two TDD red phases produced 7 temporal-cohort failures and 2 precision-boundary failures before their implementations. The final process suite includes the unchanged golden diff/report regression plus explicit CLI rejection coverage.

Review timing

This changes evidence/report behavior. Leave the PR open for a later independent diff review even after CI passes; do not merge in the creation pass.

[stacknil]

Post-CI final diff review (2026-08-20)

• Head reviewed: 61b51c8 across 9 scoped files; Mini-labs CI is green.
• Design decision: compare timezone-aware instants, require each process/link pair to share an instant, require before < after, preserve at most microsecond precision, and reject finer precision rather than truncate it.
• Main risk: inputs that were previously accepted despite equal/reversed/mismatched times, or more than six fractional digits, now fail closed.
• Compatibility impact: the successful schema and adapter contract are unchanged; whole-second golden artifacts remain byte-compatible; valid fractional inputs gain preserved precision.
• Rollback path: revert the behavior/docs commits; no schema or data migration is required.
• Review finding resolved: explicit >6-digit regressions now prevent Python datetime from silently collapsing distinct nanosecond captures.

No unresolved material reuse, quality, efficiency, clarity, privacy, or scope finding remains in the immediate review. The PR stays open for the required later independent review and is not being merged in this creation pass.