D2: Order 360 timeline endpoint + stage-entry journal

[brownjuly2003-code]

Summary

• GET /v1/entity/order/{order_id}/timeline composes exactly the QueryEngine/ServingBackend and ControlPlaneStore ports (ADR 0011): order state, stage history + pipeline trail from the pipeline_events journal, the PII-free users_enriched customer block, and linked dead-letter exceptions.
• Makes the journal's entity_id axis real on the live write paths (local_pipeline.py's 3 insert sites, clickhouse_sink.py's mirror) and adds the orders.status stage-entry writer alongside every order upsert, both backends.
• Seeds stage trails for the 8 demo orders (ops-surfaces-spec.md §1.6): ORD-20260404-1004 is the sole SLA-breach candidate once D3 wires budgets; ORD-20260404-1001 carries the full stage history. error_rate re-pins to 2/32 by arithmetic (B3 house rule).
• Excludes the new orders.status topic from /v1/lineage's scan so the pre-existing ingestion-trail endpoint keeps reporting platform movement, not warehouse stage transitions.
• sla_minutes/breached stay null until D3 lands the stages: contract block (spec §1.5 is explicitly D3's scope, not D2's) — honest degradation per the spec's own design, verified by test.

Implements D2 per docs/ops-surfaces-spec.md §1–2 and plan_endgame_02_07_26.md.

Test plan

• New unit coverage: tests/unit/test_local_pipeline_entity_axis.py (entity_id derivation + orders.status stage-row writer, DuckDB side)
• Extended tests/unit/test_local_pipeline_clickhouse_mirror.py for the new mirror call sequence
• New integration coverage: tests/integration/test_order_timeline.py (demo story pins I7, PII allow-list I3, fallback-clock honesty I12, stage-vocabulary tolerance I4, error_rate re-pin I9)
• Extended tests/integration/test_tenant_isolation.py for cross-tenant timeline scoping (I8)
• Extended tests/unit/test_control_plane_store.py with the ADR 0011 no-third-path ratchet (I1)
• Bumped the B608 nosec ratchet count for the new seed INSERT site (clickhouse_backend.py, reviewed, same static-seed pattern as its 7 existing sites)
• Full local suite: ruff check, mypy (strict) clean on touched files; pytest tests/unit tests/integration — 1817 passed, 52 skipped, 0 failed (4 pre-existing requires_docker Kafka/Iceberg errors — no Docker on this Windows dev box per policy; 1 SSE streaming flake reproduced clean in isolation, confirmed unrelated to this diff)

🤖 Generated with Claude Code

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 120 total / 28.0 per week
• Lead time for changes: avg 0.43h / median 0.0h
• Change failure rate: 78.33% (94/120)
• MTTR: 0.29h across 2 incident(s)