feat: prototype Claude Code observed-record comparisons

[kwisatzh]

Summary

Prototype; blocked on account-auth conformance. Keep this PR in draft.

Prototype investigate --claude-code-logs FILE comparisons of Claude Code
api_request records: token/cost changes, keyed contributors and comparison
quality. The unit is observed records, with finality unknown, not unique logical
requests or final provider usage.

• Accept repeated file flags for rotated collector JSONL, with aggregate limits.
• Default to two complete seven-day UTC periods, or labeled observed-span halves.
• Keep cancellation unobserved, retries distinct, incomplete components unknown
  and exact export-copy filtering explicit.
• Include a short synthetic/capture route and an existing-collector rotation
  composition with redaction, backup retention and privacy tests.
• Keep the guide prototype-only pending account-auth conformance. The rotating
  exporter requires a private directory; backup cleanup is not strict record TTL.

This PR is stacked on the shared-helper refactor. It does not change released
spend/inspect outputs, dependencies, release metadata or the root README.
The refactor may merge separately after its hosted v0.8.0 golden-output and
legacy-hash tests pass. This importer must remain unmerged until account-auth
conformance passes and Vijay approves it; main stays release-ready.

Checks

• Go 1.26.9 full race suite and vet pass; the v0.8.0 byte goldens remain unchanged.
• Claude bounded-envelope fuzz: 10,003 executions.
• 21 capture/rotation tests pass, including sentinels, actual rotation and import.
• Linux arm64: nine command cases match with networking disabled.
• Pinned LiteLLM/Postgres and example regression suite: 29 pass; two historical
  v0.7.0-binary compatibility cases skipped because that binary was not supplied.

Synthetic fixtures only. No native captures, credentials or private evidence
are included. No paid calls, release or merge requested; keep this PR in draft.