Treat a stale running_jobs snapshot as no evidence (#1812)

[erikdarlingdata]

Closes #1812.

The reported bug — confirmed in all three editions

Every edition read the LATEST running_jobs snapshot with no freshness guard, exactly as the reporter quoted. And the repetition at cooldown intervals had a second cause invisible from the query: the per-run cooldown key ({server}:{job}:{start}) is deliberately dropped once it ages past the cooldown, so a stale snapshot whose rows keep matching re-arms and re-fires the same historical run every cooldown, forever.

The fix — stale is NO evidence, in both directions

• Shared contract carries evidence quality: GetAnomalousJobsAsync returns AnomalousJobsResult (SnapshotIsFresh, Jobs). Lite and Darling probe MAX(collection_time) first and return the stale result — the row read skipped entirely — when the newest snapshot is older than the bound (or absent).
• The engine skips BOTH branches on stale evidence: no fire, and no fabricated "Long-Running Jobs Cleared" off a collector that merely stopped reporting. Active state stays untouched, so returning fresh evidence resumes real evaluation and fires or resolves from actual facts.
• The bound derives from each server's EFFECTIVE cadence (3 missed cycles, floored at 10 minutes): the shipped profiles span 2–30 minutes, so a fixed bound is either blind for the fast profile or a gag for the slow one. Lite supplies its ScheduleManager lookup (the failed-jobs fetcher's hash-match idiom); Darling supplies StoreConfigProvider.ResolveSchedule reading the live overrides field, so a control-plane reload reaches the very next check. Both fall back to the shared default.
• Dashboard parity: its own SQL-side read gets the same protection in its house idiom (fixed 10-minute DATEADD(MINUTE, -10, SYSDATETIME()), matching its Agent-driven cadence and the file's existing staleness bounds). One documented behavioral delta: its legacy loop keeps its simpler shape, so a freshly-dead collector may emit one final "cleared" there where Lite/Darling now stay silent.

Test plan

• Engine harness walks the exact reported sequence: live fire → collector dies → two cooldowns pass with NO re-fire and NO fabricated resolution → fresh-and-empty evidence returns → the REAL resolution fires
• Lite adapter against a real DuckDB store: stale → no evidence with rows skipped; fresh → rows; 60-minute cadence makes a 2-hour-old snapshot CURRENT (the hook genuinely widens the bound); empty store → no evidence
• Darling live leg extended: ages the seeded snapshot in place past the bound → no evidence; the cadence hook proven live
• Bound watched RED by mutation (MaxSnapshotAge → infinite fails the stale test)
• Full suites: Lite 1605/1605, Darling fast 3565; Lite + Darling service/viewer + Dashboard builds all zero warnings
• darling-pg CI leg

🤖 Generated with Claude Code