Windows close on the engine's signal; lateness is decided at arrival

[turbolytics]

Implements docs/superpowers/specs/2026-09-26-watermark-driven-close-design.md (spec and plan in #396; this branch carries those commits too, so its diff shrinks once #396 lands).

What changes

The manager no longer polls. The engine kicks the window's signal after the commit that moved its watermark or admitted a late row. The manager runs one pass on start, one per kick, one on the drain. No clock, no ticker, no interval. poll_interval_seconds is gone and validate names the change.

Lateness is decided at arrival, by the engine. Each placed record is classified against the window's asserted watermark, before the handler: refused past end + allowed_lateness_seconds and counted in window_late_rows_total{outcome="refused"}; written and queued for a recompute within the lateness; on time otherwise. The window table never holds a row the engine did not admit.

late_rows is replaced by allowed_lateness_seconds (default 0, Flink's allowedLateness). With a positive value a closed bucket's rows are kept that long and a late row republishes the bucket whole (emit_sql over every row it has), so the sink sees the exact value, never a delta. That needs a sink that replaces by key; validate and run refuse an appending one. window_recomputes_total counts republications. The start pass republishes every retained bucket, because the recompute set lived in memory.

time_column must be time_bucket(INTERVAL '<size>', event_time). validate refuses anything else, since the engine decides lateness from that bucket. core.BucketStart uses DuckDB's origin (2000-01-03), proven against time_bucket over a grid.

Bucket table: open / due / retained / expired, rendered to docs/windows/decisions.md.

Wire: late_rows_dropped now counts refusals, late_rows_recomputed is new, late_rows_reemitted is gone.

Configs: six examples, three bench configs and the soak config drop the removed keys, add event_time to their source, and bucket on event_time. The bluesky postgres example is the one that sets allowed_lateness_seconds: 300.

Not in this PR

• render/pipeline.yml is unchanged. The render workflow validates it against the image it pins (v2026.09.21), whose schema still requires late_rows, so the template moves in the PR that bumps the pin after the release. That PR also decides the template's bucket clock: its payload timestamp is optional and per metric, so the candidate is the request's arrival event_time, with the metric's own timestamp kept in last_at.

Verification

• go test -short -skip TestIntegration ./...: 33 packages ok (port-binding packages run outside the sandbox).
• go test -race on core, managers, simulate, cli/run, conformance: ok.
• Tooling tests 205 passed; make coverage-page regenerated; schema and CLI goldens regenerated.
• New: model with lateness shapes and the exact-value property (11,110 sequences × 8 shapes); five simulator scenarios including a driven run where the kick, not a Pass step, publishes.

Merge order

#398 (serve flake) → #396 (spec + plan) → this.