Add bounded read-only diagnosis for cached balance stage failure

[Pigbibi]

Changes

• Add a default-off manual read-only diagnostic for a failed cached-balance staging operation.
• Reuse the existing protected deployment identity; inspect service controls and narrowly scoped audit evidence.
• Match the exact project, region, service and time window again before classifying the result.
• Print only closed categories and counts; private temporary responses are cleaned up.

Validation

• Targeted synthetic tests and related workflow tests: PASS.
• Ruff, syntax, actionlint and diff checks: PASS.
• Independent review: scoped PASS after exact-target filtering correction.
• No deployment, broker call or cloud diagnosis performed by the implementation agent.