Add single-period LiteLLM session budget review

[kwisatzh]

Summary

Add a single-period LiteLLM session-budget review to investigate:

fleetdiff investigate --litellm-spend spend.csv \
  --session-budget-usd 1.00

• Lead with the result, then literal session-ID-only grouping and exact UTC boundaries. --session-budget-usd or --period implies session grouping; an explicitly different group is rejected. Prefer complete UTC days; when none exists, use and label the file's observed span.
• Mark sessions clipped only when the same literal session ID also occurs outside the period. Mark other sessions possibly clipped only within one counter window of an edge with no file rows beyond it. The streaming outside-period check reuses the capped selected-session map and verifies that the file stayed unchanged.
• Keep the 250,000-session and 1,000,000-membership limits; the limit error explains request-generated session IDs when most sessions have one call. Pin the limiter source link to commit 79645770fedc7ec2627e6468d31062f20f82aecc.
• Show exact recorded-spend and call distributions with independent sample counts, largest sessions, supplied-cap review, counter-key reuse, positive-spend durations and identity coverage. Preserve unattributed spend separately.
• Export agent_id and content-free rejection_kind using the pinned LiteLLM v1.104.0 failure writer. Keep old exports readable with unknown rejection coverage. Released v0.7.0 accepts the added columns.
• Keep two-period grouping and output unchanged. Add synthetic fixtures, agent-ID privacy checks, fuzz coverage and the session review to the network-disabled binary smoke test.

The synthetic fixture opens with:

3 of 4 sessions with complete recorded spend exceed the supplied USD 1.00 cap.

Verification

• go test -race ./... and go vet ./... (Go 1.26.9).
• Fixed-count reader and session-review fuzz checks: 1,000 inputs each.
• Pinned LiteLLM/PostgreSQL suite: 31 tests passed, no skips, including actual failure-writer shapes, negative classification cases, CSV/JSON/JSONL parity, clipping and privacy sentinels.
• Existing two-period text and JSON output compared byte for byte with released v0.7.0 across all five groups and three encodings: 30 combinations passed.
• Linux arm64 binary: seven report cases produced identical output with Docker bridge networking and --network none.
• Anonymous fresh clone with empty Go caches: both session-guide commands and the sample README command passed verbatim, using synthetic stand-in data. All 31 export/database/privacy tests passed again with no skips.
• Exact session-state limits reject oversized inputs without partial output. Tested 250,000 singleton sessions successfully and a 10-million-row singleton export's explicit cap rejection. A private higher-limit experiment remains outside this PR; the shipped limits are unchanged.
• The existing scan fuzz target hit a duration deadline on the first hosted macOS run. A separate follow-up gives this smoke 10,000 inputs and a two-minute overall timeout; its assertions and fuzz target are unchanged. Three local repeats passed.

This remains a draft for review. No installer pin, release tag or publication is included. See the session review guide for the observed-record semantics and reproduction commands.