feat(cost): add zombie hunter, Slack interactions, composite scoring

- Zombie resource hunter: detects idle EC2/RDS/EBS/EIP/NAT resources
- Slack interactive handler: acknowledge, snooze, create-ticket actions
- Composite anomaly scorer: Z-Score + rate-of-change + pattern + novelty
- Cold-start fast path for new resources (<7 days data)
- 005_zombies.sql migration

products/06-runbook-automation/saas/migrations/005_classifier_audit.sql

@@ -0,0 +1,38 @@
+-- 005_classifier_audit.sql
+
+CREATE TABLE IF NOT EXISTS runbook_steps (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    runbook_id UUID NOT NULL REFERENCES runbooks(id) ON DELETE CASCADE,
+    step_index INT NOT NULL,
+    name TEXT NOT NULL,
+    description TEXT,
+    command TEXT,
+    expected_output TEXT,
+    timeout_seconds INT DEFAULT 300,
+    requires_approval BOOLEAN DEFAULT false,
+    risk_level TEXT DEFAULT 'low' CHECK (risk_level IN ('low', 'medium', 'high', 'critical')),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE(runbook_id, step_index)
+);
+
+ALTER TABLE runbook_steps ENABLE ROW LEVEL SECURITY;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_policies WHERE tablename = 'runbook_steps' AND policyname = 'tenant_iso_runbook_steps'
+    ) THEN
+        CREATE POLICY tenant_iso_runbook_steps ON runbook_steps
+            FOR ALL
+            USING (tenant_id::text = current_setting('app.tenant_id', true));
+    END IF;
+END $$;
+
+ALTER TABLE runbook_steps ADD COLUMN IF NOT EXISTS risk_level TEXT DEFAULT 'low' CHECK (risk_level IN ('low', 'medium', 'high', 'critical'));
+
+ALTER TABLE audit_entries ADD COLUMN IF NOT EXISTS prev_hash TEXT;
+
+ALTER TABLE runbooks ADD COLUMN IF NOT EXISTS trust_level TEXT DEFAULT 'standard' CHECK (trust_level IN ('sandbox', 'restricted', 'standard', 'elevated'));
+
+ALTER TABLE runbooks ADD COLUMN IF NOT EXISTS source_format TEXT DEFAULT 'yaml' CHECK (source_format IN ('yaml', 'markdown', 'confluence'));