aggregator(feed): deep quota validation — gate burn/choices, drop malformed pools/windows at loadFeed (#2429, slice 2a of #2578) - #3070

Slice 2(a) of #2578 (Phase 2 of #2576), quota side of the feed gate — fixes #2429.

What

• isFleetFeed now requires the full section-level QuotaView shape the renderers dereference: burn present as an array and choices with its three string arrays. A feed missing them (old-collector shape) is rejected whole and falls back to fixtures like other invalid feeds, instead of crashing /quota on view.burn.map.
• New exported predicates in feed.ts: isQuotaWindow, isQuotaPool (a non-array windows fails the pool — it can never be iterated as a collection of windows, which fabricated attention flags), isBurnSegment.
• loadFeed sanitizes the gate-passed quota section via sanitizeQuotaView, built on the shared arrayOf drop-and-count primitive from aggregator: Phase 1 of #2576 — validate.ts primitives, the ingest contract in the README, and the malformed-input probe matrix #2577 (slice 1): malformed pools and burn segments drop individually, malformed windows drop out of their pool (credential-row windows too), and the counts ride out on the returned feed as quotaDropped — surfaced, never swallowed. Every loadFeed consumer (live source, server) now sees only renderer-safe pools/windows; the well-formed remainder still renders on /quota and /api/quota.json.
• Existing feed() test fixtures in feed.test.ts/validate.test.ts updated to genuine QuotaView shape (burn + choices).

Tests (laptop, bun)

• 8 new regression tests in test/feed.test.ts covering every aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429 acceptance case: missing burn/choices rejected; pools: [null]; pool missing windows; windows: [null]; windows as a string; malformed burn segments; well-formed view unchanged; loadFeed remainder + counts; loadFeed rejection path.
• Full aggregator suite: 693 pass / 7 fail — the 7 failures are pre-existing on clean main (overview/manifest/aa page family), verified identical on the primary clone; typecheck error count unchanged from main (5, all pre-existing).

Remaining in #2578 slice 2 (not this PR)

• (a2) attention-entry deep validation (aggregator(feed): isFleetFeed never checks attention entries — one null entry crashes /attention + /today, entries without a string sessionId silently collapse into one #2427)
• (b) isAaSection aggregator(aa): isAaSection never checks thresholds or sources — a section missing them passes the gate and crashes the /aa render instead of degrading #2415, isDnsSection aggregator(dns): isDnsSection never checks totalAnnualListUsd or entry priceUsd — a feed section that passes validation crashes /dns and the usage view on .toFixed #2412, isOrchestrationSection aggregator(orchestration): section gate never checks tier/goal array elements — a [null] tier item or goal task passes validation and crashes buildAttention/todayFromSection #2417 element checks
• (c) registry taskRefs aggregator(registry): malformed taskRefs elements pass every gate and crash /sessions at render — an array of bad refs merges, persists, then refUrl throws #2485
• (d) dns/aa stamps aggregator(health): dns/aa section stamps are never validated — a garbage dns generatedAt renders ageMs NaN/null, a future aa generatedAt renders age 0 (maximally fresh) for as long as the skew lasts #2242 remainder

Queue task 4006. pm-stack paths have no covering CI workflow, so verification is the laptop suite above; Codex review on this PR is the merge gate.

^{Need help on this PR? Tag @codesmith-bot with what you need.}