feat(patterns): pcie_aer detector + processor wiring (NORTHSTAR pattern #5)

[trilamsr]

Summary

Ships NORTHSTAR pattern #5 (PCIe AER + hw.gpu.io rate-collapse) per
docs/patterns/pattern-5-pcie-aer.md.
Two layers required for a verdict (no Confidence taxonomy — mirroring
xid_correlation + hbm_ecc):

• Layer 1 (kernel AER): PCIe Bus Error: severity=..., type=... line
  on a specific gpu.id (PCI BDF) extracted by the journald-kernel
  OTTL recipe.
• Layer 2 (rate-collapse): per-GPU hw.gpu.io BytesPerSecond <=
  (1 - RateDropThreshold) * BaselineBytesPerSecond on the same BDF
  within the correlation window. Default threshold 0.5 (50% drop) and
  window 5min. Causality is forward — the AER must precede the
  rate-collapse sample.

Join key: gpu.id (PCI BDF) per RFC-0013 §3, shared across the dmesg
AER preamble and the dcgm-exporter hw.gpu.pci.bdf resource attribute
on hw.gpu.io. Node is carried for the verdict prose only, not the
join key — the BDF is the proximate hardware identifier.

The verdict log record promotes operator-facing scalars onto top-level
OTLP attributes (gpu.id, kernelevents.pcie_aer.severity,
kernelevents.pcie_aer.type, k8s.node.name,
tracecore.alert.pcie_rate_collapse.drop_ratio) per the issue #270
scalar-promotion contract, via the putStrIfSet helper so an empty
upstream stamp doesn't silently match empty-filter dashboard queries.

Integration gap (filed separately, not blocking this PR)

Per ADR-0001's intentional split — library + processor wiring first,
OTTL recipes second — end-to-end firing on a real cluster needs:

• OTTL recipe: derive tracecore.alert.pcie_rate_collapse.* from hw.gpu.io counter (pattern #5 wiring) #284 — OTTL recipe to emit tracecore.alert.pcie_rate_collapse.* log
  records from raw hw.gpu.io Counter samples (the metrics→logs PR-B
  side; same blocker class as Recipe extension: emit hw.gpu.nvlink.* + wire metrics path for pattern-1 detector #260 for pattern-1).
• Recipe extension: journald-kernel OTTL stanza for PCIe AER (kernelevents.pcie_aer.*) #285 — journald-kernel recipe extension to extract
  kernelevents.pcie_aer.severity / .type / gpu.id from
  PCIe Bus Error: ... kernel lines (the existing NVRM Xid stanza is
  the proximate sibling — same file, same extraction shape).

Until both land, the detector is the v0.3 moat (pattern logic + tests)
and the processor wiring is configured-but-quiet (zero verdicts on
real input — projections find nothing). The detector library and
wiring ship independently per ADR-0001.

What's new

• module/pkg/patterns/pcie_aer.go — PCIeAERDetector library type,
  PCIeAERRecord (AER kernel message), PCIeIORecord (hw.gpu.io rate
  sample with baseline), PCIeAERVerdict output. PatternIDPCIeAER = "5";
  EvidenceKindAER = "pcie_aer";
  EvidenceKindPCIeIOCollapse = "hw_io_collapse".
• module/pkg/patterns/testdata/pcie_aer_verdict.schema.json — JSON
  schema with 10 drift falsifiers (extra field, confidence re-add,
  pattern.id numeric, pattern.id wrong value, severity outside enum,
  gpu_id empty, drop_ratio negative, drop_ratio over 1, evidence kind
  outside enum, evidence_trail under min).
• Config: pcie_aer_window (default 5min), pcie_aer_rate_drop_threshold
  (default 0.5). Validate rejects sub-1s window and threshold outside
  [0, 1].
• collectInputs grows two new typed projections (projectPCIeAERRecord,
  projectPCIeIORecord) ordered after hbm_ecc in the
  pod_event > node_condition > nccl_fr > xid > hbm_ecc > pcie_aer >
  pcie_io discriminator priority. PCIe AER is checked before PCIe IO
  because the kernel-line discriminator is a tighter regex match than
  the metric-derived bridge attribute.
• Wiring tests: emits-verdict, AER-alone (no fire), rate-collapse-alone
  (no fire), window-configurable, threshold-configurable,
  promoted-scalar attribute presence, Validate guard.

Test plan

• cd module && go test ./pkg/patterns/... ./processor/patterndetectorprocessor/... -race -count=1 — green
• make build — green (OCB compile clean against the new processor wiring)
• make check — green (golangci-lint, go vet, go mod verify)
• make doc-check — green (comment-noise diff gate clean)
• PCIeAERDetector library tests cover both-layers-emit, AER-alone (no fire), rate-collapse-alone (no fire), window-respected (collapse outside window suppressed), threshold-respected (drop under threshold suppressed), schema-conformance, schema-drift falsifier battery
• Wiring tests confirm the projections gate on the right discriminators (severity + gpu.id; bridge attribute + gpu.id) and the verdict log record carries the promoted-scalar attribute taxonomy

patterndetectorprocessor wires the PCIeAERDetector library and ships NORTHSTAR pattern #5 (PCIe AER + hw.gpu.io rate-collapse, join key gpu.id PCI BDF, default 5m correlation window, default 0.5 rate-drop threshold). Verdict log records carry pattern.* attrs plus promoted scalars (gpu.id, kernelevents.pcie_aer.severity, kernelevents.pcie_aer.type, k8s.node.name, tracecore.alert.pcie_rate_collapse.drop_ratio) for dashboard table-aggregation without parsing pattern.verdict_json. End-to-end firing on a real cluster requires the OTTL recipes tracked in issues #284 + #285; detector + wiring ship independently per ADR-0001.