feat(collector): decode SDK row-sampled points, route to ApplyAdmittedOccurrence

[zzylol]

Summary

• ingest.go: decodes the 3 reserved wire attributes an SDK running AggregationRowSampledSketch stamps on an individually-admitted raw occurrence (admitted-rows bitmask, row count, sample_p), strips them before building series identity, and skips cold-archiving a row-sampled point (it's a raw occurrence, not an aggregate sample).
• warm_sketch.go: observe() takes rowSampled/admittedRows/sampleP and, when set, tags the ObservationValue so CMS/CountSketch route through Sketch.ApplyAdmittedOccurrence (the SDK's admission decision applied verbatim) instead of the plain insert path. Families with no *AtRows sketchlib primitive (DDSketch/KLL/HLL) drop rather than silently misapply an unrelated observer — this can only happen if the SDK's AggregationRouter and this collector's AggID disagreed about which family a PolicyFingerprint targets.
• New row_sampled_test.go: rescale-by-p correctness, unsupported-family drop, and end-to-end ConsumeMetrics reserved-attribute stripping.

Context

Fourth of the 5-PR split extracting #518's remaining unmerged scope (see #538, #539, #540). Highest conflict risk of the 5 — feat/gos-unified-monitoring (the source branch) is 33 commits behind current main here and its own warm_sketch.go/ingest.go/config.go/processor.go had independently regressed relative to main's insert-time GOS wake mechanism (wakeCh/SetWakeHook) and per-family GOS priming (merged via #524-#532) — those exist only in an intermediate, superseded form on that branch. This PR was built fresh against current main (via split/pr-aggid-policyfingerprint): only the row-sampled-specific decode/route logic was ported from feat/gos-unified-monitoring; the mature GOS wake wiring and per-family priming already on main are untouched. config.go/processor.go needed no changes at all — their diffs against the source branch were pure regression noise (a GosAnisotropic field from an abandoned design iteration, doc-comment casing), not real PR-D scope.

Depends on #538's aggID/config plumbing — based on split/pr-aggid-policyfingerprint, not main.

Test plan

• go build ./... && go vet ./... && go test ./... in the processor (via restore_all.sh) — all pass, including the 3 new row-sampled tests

🤖 Generated with Claude Code