fix(aic): Persist complete scan observations and stop quota fan-out

[jiec-msft]

Problem

At source baseline 72f8ac1e, activation does not publish every resolved daily-AIC observation, and conclusion appends to a restored cache rather than the activation scan. Incomplete snapshots cause repeated historical artifact reads. Per-run error handling can also continue after quota failures and report partial accounting.

Agentic implementation plan

1. In compiler_activation_daily_aic.go and the daily-AIC runtime helpers, publish verified observations from activation and restore bounded, trusted snapshots. Validate repository, workflow, run attempt and completion metadata against fresh history before reuse; do not treat snapshots as authoritative totals.
2. Validate executed agent, detection and evals components independently. Preserve carried-forward usage, reject malformed numeric fields, and avoid counting both raw usage and overlapping summaries. Retain evals token accounting through the existing artifact collector, including ARC/DinD paths.
3. Observe quota headers on business requests, including native artifact fetches. Stop after a failed historical read; incomplete accounting must not become under_budget. Do not expand token permissions.
4. Cover warm reuse, partial snapshots, reruns, missing components, invalid numbers, quota failures and compiler topology with synthetic regressions. Release matching compiler/runtime changes and document recompilation.

Reference implementation at ccab6cfc contains the proposed changes and regression cases. Following the contribution process, please review this plan for a core-team-created PR.

Related: github/gh-aw#59759. This plan repairs observation completeness and failure handling in the existing guardrail, rather than introducing the proposed repo-memory backend.