feat(portfolio): complete RESOURCE-WP-0003 T06 optimization cases and T07 reporting

T06: optimization-case schema, fail-closed evaluator, cadence and decision
template. Every option including the baseline must present all ten decision
fields; one unknown blocks the comparison. Validated on the storage case
(Hetzner computes and loses to Scaleway by EUR 29.14/month on operator labour;
Host Europe blocks on four named gaps) and on the non-storage reef-railiance
k3s rightsizing case (low utilization is real, but nothing is costable while
the railiance01 price is unknown).

T07: portfolio report over coverage, lifecycle, utilization, cost, renewals,
risks, open cases, and next actions, derived only from committed evidence.
Portfolio spend is reported null rather than as a partial sum, unattributed
cost is a named list rather than a spread, and unmeasurable resources are
reported rather than dropped.

RESOURCE-WP-0003 is finished; both cases remain blocked_on_evidence against
live delegated records in other repositories. RESOURCE-WP-0002 is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/variance.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Compare monthly resource actuals with the immutable decision forecast."""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+METRICS = (
+    "database_gb", "stored_gb", "wal_gb", "restore_egress_gb",
+    "write_requests", "read_requests", "infrastructure_eur",
+    "internal_labor_hours", "internal_labor_eur", "total_eur",
+)
+
+
+def compare(forecast: dict, actual: dict) -> dict:
+    expected = {row["period"]: row for row in forecast["rows"]}
+    rows = []
+    for observed in actual["rows"]:
+        period = observed["period"]
+        if period not in expected:
+            rows.append({"period": period, "status": "no-forecast", "metrics": {}})
+            continue
+        metrics = {}
+        for metric in METRICS:
+            planned = expected[period][metric]
+            measured = observed[metric]
+            error = measured - planned
+            metrics[metric] = {
+                "forecast": planned,
+                "actual": measured,
+                "error": round(error, 4),
+                "absolute_percentage_error": None if planned == 0 else round(abs(error) / planned * 100, 2),
+            }
+        rows.append({"period": period, "status": "compared", "metrics": metrics})
+    return {
+        "forecast_created_at": forecast["created_at"],
+        "provider_id": actual["provider_id"],
+        "rows": rows,
+    }
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        print(f"usage: {sys.argv[0]} FORECAST.json ACTUAL.json", file=sys.stderr)
+        return 2
+    forecast = json.loads(Path(sys.argv[1]).read_text())
+    actual = json.loads(Path(sys.argv[2]).read_text())
+    print(json.dumps(compare(forecast, actual), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())