feat(api): model the merge-time policy tiers

[tdakkota]

Completes the CRD's coverage of oteldb's storage.policy with the three merge-time tiers, closing out #3.

Note

Stacked on #9 (which introduces spec.policy). Base retargets to main once #9 merges.

spec:
  policy:
    downsample:
      - {after: 24h,  interval: 5m}
      - {after: 168h, interval: 1h, agg: avg}
    precision:
      - {after: 168h, bits: 32}
      - {after: 336h, bits: 16}
    recompress: {after: 72h, level: 19}

Unlike retention/limits, all three work against released oteldb — they're in v0.48.0's StoragePolicyConfig. I verified the rendered YAML decodes through v0.48.0's tenancyOption (so agg: avg really parses), not just against oteldb main.

Validation

Both tier lists are order-independent upstream — a sample takes the coarsest tier whose after it passed — so the CRD doesn't enforce ordering. It does reject tiers the engine would ignore:

• duplicate after within a list (one of the two tiers is dead)
• non-positive downsample[].interval, or recompress.after (the block exists only to enable it)
• any tier at or past retention.maxAge — merge work whose output is dropped before it can be read

That last one only applies to a real window; maxAge: 0 is "retain forever" and doesn't bound anything.

downsample and precision rewrite parts in place and cannot be undone — lowering an after re-processes existing data at the next merge and the discarded samples/mantissa bits are gone. That's why a silently-inert tier is worth failing the reconcile over, and it's called out in the field godoc, the README and the sample. recompress is lossless and decode-transparent, so it's documented as the safe one.

Reserved paths

storage.policy is now modelled in full, so all five keys are reserved in extraConfig. Three existing tests used storage.policy.recompress as their "non-reserved" example and now use storage.log_query_parallelism, a real oteldb key the CRD still doesn't model. The README's extraConfig example moved off recompress for the same reason.

Verification

make test passes at 88.4% coverage (up from 86.9%), make lint reports 0 issues, make manifests generate && go mod tidy leaves the tree clean.

Closes #3

🤖 Generated with Claude Code