tools/stress/device-reporter: add parser + analyzer

[nikw9944]

Stack: 3 of 4 — base #3842. Followed by [#stress-reporter-cli].

This PR is the data-analysis foundation for the new `device-reporter` binary. It contains no I/O surface (no CLI, no markdown writer, no script integration) — those land in #4 of the stack. Split this way so the analyzer's data model can be reviewed without rendering pulling focus.

Summary of Changes

• `pkg/parser` — `LoadRun` aggregates one stress-run directory: `orchestrator-config.json`, `orchestrator-runlog.jsonl`, the captured agent log (state machine that builds `AgentCycle` records from `Received N lines/bytes` / `Committing config session` / `Configuration session finalized` markers), and the abort sentinel. Missing individual artifacts are tolerated; a missing run directory is a hard error.
• `pkg/analyze` — `BuildSummary` turns one `parser.Run` into the rolled-up view callers render. Two non-trivial joins: activate↔applied pairing by `user_index` (for the per-user onchain→on-device gap) and agent-cycle↔applied-bucket pairing by shared finalize timestamp (for the per-cycle table). Three linearity fits: commit-duration vs config size, diff-check-duration vs config size, onchain→on-device-gap vs active-user count. `commitCycles` surfaces a join-mismatch warning when the positional cycle↔bucket join is unbalanced.

Diff Breakdown

Category	Files	Lines (+/-)	Net
Core logic	6	+1130 / -0	+1130
Scaffolding	2	+122 / -0	+122
Tests	4	+439 / -0	+439
Total	12	+1691 / -0	+1691

Pure additive — twelve new files, no edits to existing code. Densest PR in the stack but all in one mental space (pure data manipulation).

Key files (click to expand)

• `tools/stress/device-reporter/pkg/analyze/summary.go` — top-level `BuildSummary`, the two joins, the three fits, the join-mismatch warning.
• `tools/stress/device-reporter/pkg/parser/agentlog.go` — state machine that walks the orchestrator's captured agent log.
• `tools/stress/device-reporter/pkg/parser/run.go` — `LoadRun` aggregator.
• `tools/stress/device-reporter/pkg/analyze/fit.go` — `LinearLeastSquares` + percentile helpers shared by all three fits.

Testing Verification

• Unit tests cover: parser shapes for both cEOS and real-EOS agent logs; the activate↔applied pairing edge cases (missing applied, applied-without-activate, --no-agent runs with no applied at all); the per-cycle join across commit/abort/unfinished cycle outcomes; the join-mismatch warning; the diff-check duration computation; the onchain→on-device linearity fit against a perfectly-linear synthetic dataset.

[elitegreg]

[bug] BuildSummary can label an in-progress/provision-only run as success.

• File: tools/stress/device-reporter/pkg/analyze/summary.go
• Current success condition treats this as success:
  • submit == activate > 0
  • deprovision_submit == deprovision_activate == 0
• Repro: a runlog with only provision submit/activate rows returns Outcome = "success".
• This is misleading for partial runs (especially since the reporter is documented as usable mid-run). Consider requiring deprovision completion for provisioned runs.

[nikw9944]

Good catch — fixed in c9f9f98.

You're right that the previous predicate's (submit + deprovision_submit) > 0 guard was satisfied by a provision-only mid-run snapshot, so a half-completed run got labelled "success."

Tightened the predicate to require:

• deprovision actually happened (deprovision_submit > 0), and
• either submit == 0 (the documented deprovision-only re-run case) or submit == deprovision_submit (every provisioned user was torn down — mid-deprovision stays "unfinished").

Added table-driven tests covering all seven shapes the detector has to disambiguate: no events, provision-only (your repro), full cycle, deprovision-only re-run, mid-provision, mid-deprovision, abort sentinel.

#3844 has been rebased onto the new tip.