ci: accept namespaced cgroup CPU statistics

[justinjoy]

Summary

Accept dotted namespace components in Linux cgroup CPU statistic names, such as
core_sched.force_idle_usec, while preserving numeric values, required metrics,
and CPU throttling checks.

The main strict smoke at
https://github.com/semantic-reasoning/wirelog/actions/runs/37320881243
executed CRDT and CSPA successfully on atlas-perf in the local
semantic-reasoning:ubuntu26 image. Both timing targets passed, but the capture
parser rejected the valid dotted key emitted by Linux 7.2.7 and reported
cpu_stat=unavailable. Consequently the workflow correctly remained failed
with ineligible evidence. This PR fixes that acquisition compatibility defect.

Validation

The integration fixture uses the actual ten-row kernel CPU statistic schema,
feeds it through the real capture producer, and validates the resulting
snapshots with the real telemetry checker. Malformed keys, nonnumeric values,
missing required metrics, and throttling changes must remain failures.

Focused telemetry and Docker contracts, Python encoding checks, shell syntax,
and the Bash construct ratchet are validated locally. Dedicated-runner
acquisition must be repeated on canonical main after merge. No timing target,
CoV, correctness, or host eligibility requirement is relaxed.

Related: #2085; prerequisite for completing #2077 validation.

CI repair

Amended the original commit to replace GNU-only sed -i in the telemetry
fixture with portable redirected output and mv. Also added exactly four
missing SBOM records from the committed hosted calibration workflow.

Linux fixture execution, a BSD sed compatibility shim, Docker contracts,
encoding checks, and the strict SBOM snapshot gate passed locally. Repeated
clean scans were identical with the declared nanoarrow and xxHash sources.
Local Syft was 1.51.0; CI pins 1.50.0, whose failure log shows the same four
missing records. Actual macOS and pinned-Syft verification are rerunning in CI.

Remaining CI failures repaired

Run 37406713951 passed the macOS sanitizer and required SBOM gate. Its remaining
failures were the target-miss fixture assertion in GCC TSan and Windows' shell
walltime check.

The target-miss assertion now saves checker output before checking the verdict,
so an early grep -q exit cannot make trailing producer writes fail under
pipefail. Producer failures remain failures. A controlled delayed-tail
reproduction demonstrated status 141 in the old pipeline and success with file
capture, and verified that nonzero producer status is still rejected.

Windows completed all functional tests but recorded 31.57 seconds for this
fixture, exceeding half of its old 60-second timeout. Only this fixture now has
a documented 120-second timeout. The global 50% rule is unchanged: 31.57 seconds
passes and 60.01 seconds fails the focused walltime validation. Related fixture,
Bash, Docker, encoding, timeout, and introspection checks passed locally. Actual
GCC TSan and Windows confirmation is rerunning on the amended commit.