feat(status): port the four tag-derived notices from Go's spawn status (#56)

[scttfrdmn]

Closes #56.

spawn status answered "what did you configure" and nothing else. Go appends four notices after its remote spored status output (cmd/status.go:130-134); none were ported, and every one of them is pure tag reading a browser can already do.

The headline gap. spored writes spawn:dns-status + spawn:dns-error when registration fails, specifically so the failure isn't buried in the instance's journal (spawn#435) — and nothing in spawn-ts ever read them. A portal user got an FQDN that never resolves and no explanation, while the diagnostic sat in a tag DescribeInstances had already returned.

What's here

A pure src/core/notices.ts returning structured { kind, level, text, detail } rather than pre-formatted strings, so the CLI, the dashboard and the portal render one source three ways.

notice	says
lifecycle-protection	who enforces the deadline, when it falls, and the worst-case compute cost to it
dns	registration failed, with spored's own reason
elastic-ip	an EIP still billing on a stopped instance (~$3.60/mo), + the release command
spored-upgrade	the running spored is older than the newest release

lifecycleProtection is the counterpart to accumulatedCost(), which reports only what's been spent. The ceiling is the number that tells a user whether to worry.

elasticIpNotice matters most on a stopped instance: stopping pauses compute billing, so the user believes they've stopped paying — and an unassociated EIP is charged precisely because nothing is using it.

Absence is never smoothed into reassurance

Per #63, each notice has an input it can't do without, and a missing input omits the notice rather than answering optimistically:

• no spawn:dns-status → no notice. It does not mean registration succeeded; an older spored simply never wrote the tag.
• no latestSporedVersion → no notice. It does not mean spored is current. The value is passed in rather than fetched, because Go's release check hits the GitHub API and that's the embedder's call.
• no EIP lookup → no notice; a lookup that fails is its own warn notice naming the error.

That last one is a deliberate divergence from Go. GetInstanceElasticIP (pkg/aws/cleanup.go:219) returns nil, nil on any API error, so a missing ec2:DescribeAddresses permission is indistinguishable from a clean bill of health — in the one check whose entire job is catching an unnoticed charge.

Two honesty constraints carried over verbatim and asserted in tests: the out-of-band reaper is described as a backstop "if deployed" (it runs in the infra account and isn't authoritatively visible from the launch account), and the cost figure keeps its "compute only" label since it excludes EBS and network. It's skipped entirely when the instance has no recorded price rather than shown as $0.00.

Wiring

EC2Provider.lookupElasticIp delegates to the shared lookup with the credentials it already holds, and the CLI falls back to it when the ShellCtx supplies no override. Without that the notice would exist but never fire in the real app — terminal.ts builds a bare ShellCtx. New permission: ec2:DescribeAddresses (optional; its absence is reported, not fatal).

The dashboard renders the two notices its meters don't already cover, escaped — spawn:dns-error is whatever the DNS endpoint returned, and it lands in innerHTML.

Also

Driving the built CLI (not the suite) surfaced an adjacent line: humanRemaining() already returns "expired", so status on an overdue instance read ttl: 4h — expired left (terminates).

Not ported, deliberately

The remote spored status output these notices are appended to (needs a shell on the box), and Go's fallback of parsing the spored version out of that output. compareSemver is a faithful port of libs/update's comparison, so the two tools never disagree about whether an upgrade exists.

Verification

• 451 → 503 tests. Typecheck, npm test, npm run build, npm run build:lib all clean.
• Each new guard was proven to catch the bug, not assert the fix. Five mutations reverting notices.ts to the absent/Go-equivalent behaviour (EIP error collapse, no past-due branch, no cost ceiling, no NaN guard, dropped DNS detail) → 11 failures across notices.test.ts and commands.test.ts. Removing the dashboard's escapeHtml → 1 more.
• Driven end to end, not just tested: the built CLI through a live/stopped/past-due/failed-lookup sequence, and the dashboard in Chromium — where the new notice CSS was confirmed to actually land (.notice.warn red-on-tint with a border, .notice.info visibly subordinate).