feat(reads): align live queries to Raft horizons (EN-1946)

[gfyrag]

Stack 2/7 for EN-1946. Consumes the projection certificates from the preceding PR to align each live read only with the projections it uses, at the fixed main-store snapshot horizon.

[NumaryBot]

🛑 Changes requested — automated review

The alignment logic is generally consistent, but the new audit projection gate changes error semantics for invalid filters during rebuild or disabled states.

[codecov]

Codecov Report

❌ Patch coverage is 75.45455% with 27 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.09%. Comparing base (e04e577) to head (b515155).

Files with missing lines	Patch %	Lines
internal/query/aligned_snapshot.go	66.66%	9 Missing and 5 partials ⚠️
internal/application/ctrl/controller_default.go	75.47%	9 Missing and 4 partials ⚠️

❌ Your patch check has failed because the patch coverage (75.45%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@                           Coverage Diff                            @@
##           feat/en-1946-projection-certificates    #1890      +/-   ##
========================================================================
+ Coverage                                 71.16%   77.09%   +5.92%     
========================================================================
  Files                                       469      478       +9     
  Lines                                     50561    51505     +944     
========================================================================
+ Hits                                      35984    39708    +3724     
+ Misses                                    11352     8337    -3015     
- Partials                                   3225     3460     +235     

Flag	Coverage Δ
e2e	77.09% <75.45%> (+5.92%)	⬆️
scenario	77.09% <75.45%> (+5.92%)	⬆️
unit	77.09% <75.45%> (+5.92%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[NumaryBot]

NumaryBot posted 1 new inline finding.

Summary: #1890 (comment)

[NumaryBot]

🟠 [major] Validate audit filters before checking projection state

When the audit projection is disabled or rebuilding, any malformed or unsupported filter is classified by AuditFilterNeedsIndex as needing the index, so this early return reports ErrIndexBuilding instead of the InvalidArgument that CompileAuditFilter would produce. Clients can therefore receive a transient availability error for permanently invalid input; validate the filter before applying the projection-state gate.