docs: propose how summary coverage is computed for every operator

[zzylol]

Design doc for discussion before code: how a summary state's coverage (source, population, time) is computed for every operator, not only the narrow SummaryAgg → Filter/TimeRange → Scan path in #646.

Before this PR: coverage is computed only for SummaryAgg (#646, narrow path walk) and SummaryMerge (#560). No document says what coverage any other operator's output has, although a summary's input can be any sub-DAG.

After this PR: a proposal with one rule per operator, computed bottom-up, with an explicit "unknown" that only blocks merges. For each summary operator it says what SummaryCoverage::derive(node, time_range) returns (SummaryAgg derives, SummaryMerge takes the disjoint union, readouts and maintained populations carry none), and it lists the code interface: derive, merge_disjoint, validate, OperatorNode::with_time_range, and the four places that call derive. It also separates Planner coverage from ASAPQuery-backend's SDS (plan-time "which observations" vs. per-record windows and completeness).

Open questions for review:

1. Should every node carry coverage, or only summary states?
2. How to represent "unknown" (Known | Unknown, Option, or a per-source map)?
3. Should the Planner keep absolute time_ms, or only the time shape and leave windows to SDS?
4. Confirm the operator table, especially Aggregate, Join and PromqlInfoEnrich.

#646 stays the narrow first version; a follow-up PR implements this once the questions are settled.

🤖 Generated with Claude Code

[zzylol]

Moved into #646 (commit b174319): the design doc now ships with the SummaryCoverage::derive implementation it describes. Closing.