docs(integration): Phase E observability spec (standards#100)

Phase E §3 traffic-shift sign-off has four success criteria (rollout
runbook §3.1): p99 latency within Phase D baseline × 1.5, gateway-origin
5xx ≤ baseline, no circuit-breaker trips, no X-Trust-Level mismatches
in BoJ access logs. The runbook §4 names the signals at the human level
but stops short of giving the on-call a query they can paste. This spec
fills that gap.

Maps each signal in runbook §4.1 (six gateway-side) and §4.2 (three
BoJ-side) to:
  1. The telemetry event emitted by the gateway (audit §5 / §1.6).
  2. The Prometheus metric exported by `telemetry_metrics_prometheus_core`
     against the canonical `telemetry_metrics/0` declaration in
     `http-capability-gateway/lib/http_capability_gateway/application.ex`
     lines 259-296 (request lifecycle, policy lookup, access decision,
     backend forward, error, minikaran anomaly).
  3. A PromQL query template the operator can paste verbatim.
  4. An alert threshold anchored to a canonical source — the rollback
     trigger value from runbook §5.1, the perf contract tolerance
     ratio, or the load-profile §2 SLO budget. Where the absolute
     number depends on Phase D-4 baseline collection, the spec names
     the formula and the lookup site (`bench/baseline.json` after
     `_status` flips to `active`) instead of inventing a value.

§5 closes the loop: every runbook §5.1 rollback trigger is cross-
referenced to the PromQL alert rule in this spec. Three follow-up
gaps are surfaced honestly rather than papered over:

  - Circuit-breaker state has no dedicated telemetry event today;
    the 503 spike + log inspection is the interim signal until a
    `[:http_capability_gateway, :circuit_breaker, :state_change]`
    event lands. Spec calls this out as a post-Phase-E gateway
    follow-up, not a Phase E blocker.

  - Policy reload has no telemetry event either; logged via
    `Logger.info("Policy compiled successfully", …)`. Treat as a
    log-based alert until the event is added.

  - VeriSimDB write failures are cast-only (audit §4); no metric
    surface today. Phase E §1.3 already lists VeriSimDB integration
    status as an `!OWNER:` confirmation; this spec confirms the
    metric-side consequence.

Edits the rollout runbook §4 lead-in and Appendix B cross-reference list
to point at the spec, so an operator landing in §4 can find the queries
without grep. No changes to the §4 signal list itself or to any §1/§3/
§5/§6 procedure — the runbook stays normative; the spec is its
declarative half.

Does not invent percentile budgets, does not commit a dashboard URL,
does not pre-empt the §6.4 Trustfile flip. Per single-lane HCG channel
discipline (rolled in PR #38 of http-capability-gateway, PR #168/#173/
#224 of boj-server): joint-close is owner-only; this PR refs but does
not close standards#100.

Refs hyperpolymath/standards#91
Refs hyperpolymath/standards#100

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: hyperpolymath