Add identity audit since-window gate

[saagpatel]

What

• Adds --identity-since to the opt-in Operator OS identity-resolution audit.
• Windows timestamped local stores: bridge-db activity, session-costs, and notification-hub durable events.
• Skips untimestamped Notion snapshot rows in since-window mode.
• Documents backlog-vs-regression usage.

Why

The identity backlog remains noisy, but producer fixes need a current regression gate. This lets us verify new drift after a known producer-fix timestamp without migrating historical rows first.

Verification

• PYTHONDONTWRITEBYTECODE=1 uv run pytest -q tests/test_operator_os_seam_linter.py tests/test_project_registry.py tests/test_portfolio_truth.py -p no:cacheprovider
• uv run ruff check src/operator_os_seam_linter.py tests/test_operator_os_seam_linter.py
• python -m py_compile src/operator_os_seam_linter.py tests/test_operator_os_seam_linter.py
• uv run python -m src.operator_os_seam_linter --truth output/portfolio-truth-latest.json --json | jq '{state, findings_count:(.findings|length)}'
• uv run operator-os-seam-linter --identity-resolution --identity-since 2026-07-03T13:02:06Z --truth output/portfolio-truth-latest.json --json

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2fc21c3e0d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skip notification_feed when applying identity-since

When --identity-since is used against a notification DB that still contains notification_feed (including a migration DB that also has durable_events), the branch above selects notification_feed and this new created_at filter is never reached. That means stale backlog rows from the untimestamped feed are still audited and can fail the intended post-fix regression gate even though the CLI/README describe the window as applying only to notification-hub durable events. In since-window mode, skip the feed or prefer the durable_events query.

Useful? React with 👍 / 👎.