tools/stress/device-observer: abort decider + sentinel

[nikw9944]

Summary of Changes

• Replace the abort decider stub with a state machine that ticks at --sample-interval and evaluates ten triggers (provision p95 / single-user, deprovision p95, sustained CPU, two doublezero-agent error counters, two agent-log substring patterns, agent silence, ledger heartbeat staleness).
• On the first match the decider writes a JSON sentinel atomically (<abort-file>.tmp + rename) and cancels the observer's root context via OnFire, so the process exits 0 and the orchestrator's existence-only abort.Watch picks up the file. d.fired is only set after the rename succeeds, so a transient filesystem error retries on the next tick.
• Expose LatestCPUPercent() on the eAPI sampler: parse the %Cpu(s): line from the show processes top once | json envelope (procps top -bn1 output), sum the non-idle fields, and tolerate locale-decimal commas.
• Add --force to refuse start (or, with --force, remove) a stale sentinel left from a previous run.
• Document the trigger table, sentinel JSON shape, exit-on-fire behavior, stale-sentinel guard, and ledger-heartbeat contract in the README; the contract is forward-compatible (an absent heartbeat file suppresses the trigger).

Fixes #3796

Diff Breakdown

Category	Files	Lines (+/-)	Net
Core logic	2	+394 / -19	+375
Scaffolding	1	+49 / -10	+39
Tests	3	+591 / -0	+591
Docs	2	+72 / -12	+60
Total	8	+1106 / -41	+1065

Roughly half the change is tests (one case per trigger plus sentinel-atomicity, write-failure retry, and CPU-span guards); the rest is the decider state machine, the CPU parser, and the main.go wiring.

Key files (click to expand)

• tools/stress/device-observer/internal/abort/decider.go — full state machine: Sources of function-typed snapshot getters, trigger constants, tick() ordered as p95 → single-user → deprovision p95 → CPU sustained → counter deltas → log patterns → agent silence → ledger heartbeat, atomic sentinel write with retry on failure.
• tools/stress/device-observer/internal/sample/eos.go — LatestCPUPercent() and parseCPUPercent() over the show processes top once | json envelope; locale-decimal tolerant.
• tools/stress/device-observer/cmd/device-observer/main.go — --force flag, checkStaleAbort(), capture collector values into locals, build abort.Sources, wire OnFire to the errgroup root cancel.
• tools/stress/device-observer/internal/abort/decider_test.go — one test per trigger, sentinel-once + atomic-rename, write-failure retry, OnFire-invoked-once, CPU span guard, percentile helpers.
• tools/stress/device-observer/internal/sample/eos_test.go — CPU parser fixtures (procps, busybox, comma-decimal locale, missing line) and the LatestCPUPercent snapshot update.
• tools/stress/device-observer/README.md — trigger table and Operator-contract section (sentinel format, exit-on-fire, stale-sentinel guard, ledger-heartbeat contract).
• tools/stress/device-observer/cmd/device-observer/main_test.go — checkStaleAbort tests (refuses, force-removes, missing no-op).

Testing Verification

• go test ./tools/stress/device-observer/... passes (all trigger tests, sentinel atomicity, write-failure retry, CPU parser fixtures including comma-decimal locale, CPU-span guard, stale-sentinel cases).
• go vet ./tools/stress/device-observer/... clean.
• CPU-sustained trigger requires both ≥ minSamples retained AND samples spanning ≥ cpuSustainedWindow (60 s) so the first 4 samples can't fire on their own at startup; TestCPUSustainedBelowSpan covers the guard.
• Sentinel write failure does not strand the decider: d.fired flips only after rename succeeds; the next tick retries (covered by TestSentinelWriteFailureRetries).