perf(process-storms): rolling-window AORC scan, read each year once (~3-5x, opt-out)

[nghiemv]

What

The upstream scan re-reads each AORC hour once per overlapping storm window
(storm_duration / check_every_n_hours times — 3× at 72h/24h, ~12× at 72h/6h).
The rolling-window scan sweeps each year once: keep a running cumulative
sum, snapshot at the indices each storm-date needs, so a window sum is
snapshots[end] - snapshots[start]. Complexity O(area × D × num_dates) →
O(area × T); peak memory bounded to ~one time-chunk + the snapshot pool. The
speedup scales with cadence: ~3× at 72h/24h, ~5× measured at 72h/6h.

Ported from the fork's cumsum_scan, renamed rolling. Monkey-patches
collect_event_stats via install()/restore() around new_collection, gated
on CC_ROLLING_SCAN.

Default-on: yes, with confidence

Shipped default-on (CC_ROLLING_SCAN=1). This is justified, not aspirational:
end-to-end parity is confirmed bit-identical on a real production domain (see
below), so default-on changes speed, not results. CC_ROLLING_SCAN=0 remains a
one-flag escape hatch to the exact upstream per-date path.

Validation (end-to-end, real AORC) — ✅ confirmed

Real indian-creek production domain (fetched geometry), fast
aorc-cache-conus, 2-year window, full pipeline (scan → DSS → grid → upload):

• Parity — bit-identical. rolling vs baseline (CC_ROLLING_SCAN=0)
  storm-stats.csv: 2925 / 2925 rows byte-exact (min/mean/max/x/y), 0 diffs.
• Perf — ~5.4×. rolling 585.8s vs baseline 3137.7s total (72h/6h).
• Unit: test/test_rolling_scan.py parity-tests the numerical core against
  naive window sums (chunk-size invariant, NaN-as-zero, toggle). 4 pass.

CI gates (verified locally on this rebased branch)

ruff check src/ ✅ · ruff format --check src/ ✅ · docker compose build ✅ ·
built image imports rolling_scan, enabled() → True.

Reviewer notes

• Rebased onto current main as a single commit; diff is rolling_scan.py
  (+680) + 8-line wiring in process_storms.py + the test. No deletions; no
  conflict with the merged pre-flight (feat(process-storms): fail-fast AORC pre-flight before the scan #15) or cache-dir attr (Implement cache directory attribute for plugin #17).
• Reproduce parity: run any payload twice with CC_ROLLING_SCAN=1 then =0
  and diff the collection's storm-stats.csv — rows are byte-identical.

env	default	effect
CC_ROLLING_SCAN	1	rolling-window scan; 0 = upstream per-date loop
CC_ROLLING_CHUNK_HOURS	720	streaming time-chunk (memory vs overhead)