feat(patterns): hbm_ecc detector + processor wiring (NORTHSTAR pattern #3)

[trilamsr]

Summary

Ships pattern #3 (uncorrectable HBM ECC) per docs/patterns/pattern-3-hbm-ecc.md. Two layers required for a verdict — a single layer alone emits nothing.

• Layer 1 (DCGM): uncorrected double-bit volatile ECC counter delta on a GPU. Discriminator: error.type=uncorrected AND error.subtype=double_bit AND error.persistence=volatile AND Delta >= threshold.
• Layer 2 (kernel): Xid 48 / 63 / 64 on the SAME gpu.id (PCI BDF) within 5min default window. Causality flows forward — Xid must be at or after the ECC delta.
• Join key: gpu.id. Same-node is implied but not required for the join (the GPU identifier is the proximate hardware-fault key).

Why two layers required

• ECC delta alone: operators already see the rising counter on dashboards; pattern's value is the kernel-level confirmation that the GPU is failing.
• Xid alone: may fire xid_correlation if a pod evicts on the same node — that's a node-scoped pattern, distinct from this GPU-scoped one. Operators get raw kernelevents.xid telemetry already.

What's new

• module/pkg/patterns/hbm_ecc.go — HBMECCDetector library type, HBMECCRecord projection, HBMECCVerdict output. PatternIDHBMECC = "3", EvidenceKindHBM = "hw_error".
• module/pkg/patterns/testdata/hbm_ecc_verdict.schema.json — JSON schema with 10 drift falsifiers.
• XidRecord extended with optional GPUID (PCI BDF from the journald-kernel OTTL recipe per RFC-0013 §3). xid_correlation ignores it; hbm_ecc requires it.
• Processor wiring: projectHBMECCRecord + appendHBMECCVerdict mirror the xid_correlation shape. Config grows hbm_ecc_window (default 5min) + hbm_ecc_delta_threshold (default 1).

Follow-up gap (not a workaround)

The pattern doc names hw.errors as a Counter on the metrics pipeline; the patterndetectorprocessor consumes log records. The detector wires up against hw.errors.delta-shaped log records but no OTTL recipe today derives that log shape from the upstream metric. Tracked in #273 — needed for end-to-end firing in a real deployment; the detector library is the v0.3 moat and ships independently per RFC-0013.

Test plan

• cd module && go test ./... -race -count=1 — all green
• make build — exit 0
• make check — golangci-lint 0 issues, go vet clean, go mod verified
• Window-edge fenced both sides: EdgeOutOfWindow (5min+1s, no fire) + EdgeAtWindowBoundary (exactly 5min, must fire)
• Negative paths: ECC alone, Xid alone, wrong Xid code, corrected ECC, cross-GPU, pre-ECC Xid (causal direction)
• Schema drift battery: 10 falsifiers (extra field, confidence re-added, pattern.id numeric, pattern.id wrong value, xid_code string, ecc_delta negative, ecc_delta zero, evidence_kind outside enum, evidence_trail under min, gpu_id empty)
• Wiring: emits-verdict, xid-alone, ecc-alone, out-of-window, cross-gpu, window+threshold configurable

feat(patterns): hbm_ecc detector (NORTHSTAR pattern #3) — emits a verdict when an uncorrected double-bit volatile DCGM ECC counter rise joins an Xid 48/63/64 on the same gpu.id within the configurable window (default 5min). Two new YAML config keys: hbm_ecc_window, hbm_ecc_delta_threshold.