feat(observability): unsampled tick heartbeat, interval-relative breach, slow_ticks doctor check, host-load stream (vp-qvqk)

[voxist-merge-bot]

Implements all four asks of vp-qvqk (gascity-core observability: the tick-health canary was a 5s constant in a 30-55s regime, breach=true on 102/102 events with nothing consuming it; tick sampling was biased; no host-load stream existed).

What changed

1. Emit every tick (cmd/gc/city_runtime.go): controller.tick_completed now fires once per completed reconcile tick. The old breach-or-every-10th gate made the stream a biased sample — fast ticks were silently omitted, so period/median arithmetic over it was valid only while every tick breached, and would have reported a phantom regression the moment the controller got healthy. One event per tick is patrol-cadence volume (~2/min), not a hot path.
2. Interval-relative breach threshold: threshold_breach is now duration >= 2 × [daemon] patrol_interval (legacy absolute 5s only when the interval is unknown/non-positive, so the flag can never degenerate to always-true). A canary must be calibrated to the regime it watches.
3. Consume the flag (internal/supervisordoctor + cmd/gc/supervisor_doctor.go): new slow_ticks doctor check reads threshold_breach over the doctor window (bounded tail scan, ≤512 events) and emits a doctor.alert when any inspected tick breached — the consumer that makes the flag load-bearing.
4. Host-load event stream (cmd/gc/host_load.go, internal/events/hostload_payloads.go): new host.load_sample event (load1/5/15, logical cores, runnable-process count, summed per-process %CPU) at patrol cadence on its own goroutine, so a wedged tick cannot stall the series that attributes the wedge. Runnable + %CPU discriminate CPU oversubscription from blocked-on-I/O — Darwin load averages alone cannot (they count uninterruptible waits).

Wire discipline

host.load_sample carries a typed payload struct but is deliberately left out of KnownEventTypes and the payload registry — the same deferral as provider.health_gate_alert — because RegisterPayload would sweep it into the generated EventPayload OpenAPI union ahead of the SSE-projection follow-up. Subscribers receive it via the custom-event envelope. openapi.json/genclient regenerated for the threshold_breach description change only (1 line each).

Gates

• go vet ./... clean; make dashboard-check green; spec-sync + genclient-sync tests green.
• New tests: unsampled emission (25/25 events), interval-relative breach table (incl. the vc-wz5 regime: 55s tick @ 30s patrol must NOT breach), fallback threshold, loadavg/ps parsers (Darwin + Linux shapes), sampler goroutine emit/cancel/warn-once, slow_ticks alert + clean-window + outside-window doctor-subset tests.
• make test-fast-parallel: green except the pre-existing internal/productmetrics PATH_MAX failures documented in vp-zq8h (reproduced there on unmodified eb743642c, this branch's exact base). Local pre-push gate bypassed for that reason; this PR's CI is the authoritative gate.

Bead: vp-qvqk (voxist-platform store). Precedent for repo/PR shape: vp-7mjx → #91, vp-qgil → #90.

[bourgois]

Approving per /review — dashboard client regen verified, observability change reviewed APPROVE. CI green (64/64, no failures).

[bourgois]

Re-approve after CHANGELOG rebase onto main. Reviewed APPROVE; CI green.