fix(resource-contract-telemetry): remediate #26 review — real observe-mode bug + validator teeth

[mdheller]

Remediates all four Copilot findings on #26. One of them is a genuine correctness bug in the verdict algebra that reached main — and the docstring had been reconciled to justify the bug rather than fix it.

1. Real bug — observe-mode exceedance was VIOLATION

expected_verdict returned VIOLATION for enforcement == "observe" whenever peak > limit and fired_count == 0. But VIOLATION is a broken enforcement promise, and observe mode makes no promise — it is the honest, declared "gauge, not gate" (ResourceContract requires an observeOnlyReason for it). Flagging its exceedance VIOLATION:

• accuses a gauge of failing to be a gate,
• punishes honest declaration (pushing authors away from observe to dodge the false VIOLATION),
• trains the learning loop to demand fixes for things explicitly declared not-controls.

Fixed: the VIOLATION branch now guards on enforcement != "observe"; an observe-mode exceedance is INCONCLUSIVE. The exceedance is not hidden — it still flows as a resource-saturation TelemetrySignal regardless of verdict, so an operator can still promote the gauge to an enforcing limit. The mapping gains an explicit rule observe_mode_exceedance_is_inconclusive_not_violation; the never-fired rule and the doc verdict table gain the guard.

2. Validator was satisfiable by its own comments

Token checks were bare substring (tok in text) — a required object/rule/topic could be deleted from structure but still named in a comment and pass. That is the paper-control shape this file exists to reject. Replaced with anchored regex over comment-stripped lines.

Proven by negative control: moving ops.learning.feedback.v1: into a comment now fails (rc=1), where the old substring check passed.

3. Docstring claimed re, used neither

Declared-vs-actual mismatch, in the file whose job is catching those. Now it genuinely uses re, and the docstring matches.

4. Algebra only tested via the script's own example

Added tools/tests/test_resource_contract_verdict.py (10 cases) pinning every precedence branch in make test — gate-ineligible, proved, canonical violation, within-limit, all three enforcing modes, and the observe-mode carve-out that was the bug — so a regression is caught even if the example file changes.

Verification

• validator 27 checks; new pytest 10/10; make validate OK
• negative controls: comment-only topic → rc=1, mislabeled verdict → rc=1, restored → rc=0
• The one make test failure is a pre-existing test_serve port-race flake — a different serve test fails each run (rejects_oversized_body, then is_disabled_by_default), it passes in isolation and on origin/main, and nothing in this PR touches HTTP ingest. Flagged separately, not fixed here.