feat(patterns): xid_correlation detector + processor wiring (v0.3.0 NORTHSTAR pattern #3)

[trilamsr]

Summary

Third real detector in module/pkg/patterns/ — closes v0.3.0 NORTHSTAR O1 ("3 patterns at v0.1.0") alongside pod_evicted (#14) and nccl_hang (#15).

Pattern: a GPU Xid kernel event (carrying the customer-stable kernelevents.xid attribute) followed within a configurable window (default 60s) by a pod eviction on the same node → one verdict per (Xid, evicted_pod) tuple. Operator-actionable: "Xid 79 on gpu-node-0001 → training/job-rank-3 evicted 10s later" with remediation pinning the node to drain and the pod to reschedule.

Detector (module/pkg/patterns/xid_correlation.go):

• XidCorrelationDetector zero-value usable; CorrelationWindow overrideable (defaults to DefaultXidCorrelationWindow = 60s).
• Evaluate(xids, events) joins on (node, time-within-window) with the most-recent Xid winning the proximate-cause attribution.
• Causal-direction guard: eviction BEFORE Xid does not correlate (mirrors pod_evicted's future-transition exclusion).
• Deterministic output sorted by (eviction_time, EventUID).

Verdict shape — single vs multi-layer decision: structurally two evidence surfaces (kernel_event + pod_event in causal order in the evidence trail), but emission rule is "both layers joined or no verdict". Xid-without-eviction is already operator-visible via the raw kernelevents.xid telemetry; an Xid-only verdict would duplicate that signal. So Confidence / MissingLayers are omitted (dead-fields discipline from PR #250 review). Mirrors the nccl_hang shape.

Multi-pod decision: one verdict PER evicted pod (not one verdict listing all). Per-pod is the operator-actionable shape — each verdict's Remediation pins a specific pod to drain/recreate so alert routing fans out by pod owner; collapsing would force operators to parse a list and lose per-pod routing.

Schema (testdata/xid_correlation_verdict.schema.json): additionalProperties:false, pattern.id const="16", evidence_trail.kind enum=["kernel_event","pod_event"], minItems:2 (both layers required). 7-row drift-rejection battery covers re-introduced confidence/missing_layers, evidence-minimum violation, kind-enum, and pattern.id numeric vs string drift.

Wiring (patterndetectorprocessor):

• New Config.XidCorrelationWindow YAML field (default 60s, floor 1s), validated alongside the existing window fields.
• collectInputs returns a fourth typed slice ([]patterns.XidRecord) built by projectXidRecord, which gates on kernelevents.xid and reads the host node from the resource attribute k8s.node.name (the standard k8sattributes / resourcedetection stamp on a DaemonSet — same pattern projectNodeCondition uses). Per-record k8s.node.name fallback for non-DaemonSet emitters.
• appendXidCorrelationVerdict mirrors appendNCCLHangVerdict's wire format — broken-out scalar attrs plus full pattern.verdict_json.

Recipe alignment: docs/integrations/journald-kernel.md §"Customer-stable attribute mapping" already documents kernelevents.xid (int) as the OTTL-stamped surface. No recipe update needed; the existing pipeline emits exactly what the detector consumes. gpu.id (PCI BDF) is also stamped but intentionally not projected — the detector doesn't use it yet, so it stays available on the raw record without entering the pattern library as a dead field.

Test plan

• cd module && go test ./pkg/patterns/... ./processor/... -race -count=1 — green
• make build — collector binary compiles
• make check (golangci-lint + go vet + go mod verify) — 0 issues
• TDD red-test-first: both xid_correlation_test.go files failed to compile/assert before their impl landed
• Detector test cases: positive Xid 79 → eviction, no-eviction negative, cross-node negative, out-of-window edge (61s default), multi-pod per Xid (3 verdicts), window-configurable, pre-Xid eviction excluded, non-evicted-hint ignored, deterministic order, most-recent-Xid-wins
• Schema-conformance + 7-row drift-rejection battery
• Wiring tests: positive verdict emission, healthy non-emission, window override
• TestConfig_Validate extended with sub-1s xid_correlation_window floor case
• TestFactory_Surface pins DefaultXidCorrelationWindow (and the previously-unpinned DefaultNCCLHangThreshold) on the factory's default config

feat(patterns): add xid_correlation detector (v0.3.0 NORTHSTAR pattern #3) — correlates GPU Xid kernel events (`kernelevents.xid` attribute per RFC-0013 §3) with downstream pod evictions on the same node within a configurable window (default 60s). Emits one verdict per evicted pod so alert routing can fan out per pod owner. Wired into patterndetectorprocessor; configurable via `xid_correlation_window` YAML field.