fix(control-plane): reject cost evidence quoting another dataset

[zzylol]

Reject cost evidence that quotes another dataset

Stacked between #786 and #742: #728 → #786 → this PR → #742 → #775.

Before: WorkloadCostEvidence quotes are matched to candidates by full manifest equality. A quote whose dataset_identity differs from the deployment simply fails to match, so a foreign quote is silently ignored and the remaining quotes still choose the plan. Only when every quote is foreign does selection fail, and then with a generic "no feasible completely costed candidate" error.

After: WorkloadCostEvidence::validate compares every quote's manifest.dataset_identity (both namespace and dataset) with PhysicalDeploymentContext.dataset_identity. One evidence generation prices one dataset, so a single foreign quote rejects the whole generation with a typed error:

CompileError::CostEvidenceDataset { expected, found } // found = first mismatching quote

No wire-format change: evidence gains no top-level field; the identity already carried by each quote is checked.

Tests

evidence_quoting_another_dataset_is_rejected_whole covers:

• matching evidence still selects;
• one quote with a different namespace → CostEvidenceDataset with the expected/found identities;
• same namespace, different dataset → same error;
• both select_lowest_cost_candidate (PromQL) and select_lowest_cost_metricsql_candidate.

Validation

• cargo test -p control_plane --lib: 450 passed.
• cargo test -p control_plane --no-fail-fast: all test targets pass except discovery_snapshot (unsupported workload snapshot version 2; only version 3 is supported), which fails identically on the test: assert Level-1 candidate membership and account for every rejection #728 base and is unrelated to this change.

🤖 Generated with Claude Code