Fix cyberDigital burst volatility (#4006)

* fix(resilience): cap cyberDigital daily bursts

* fix(resilience): simplify cyberDigital cap to per-snapshot, drop inert day-bucketing

The cyber:threats:v2 feed carries no usable cross-day spread (verified live
2026-06-01: firstSeenAt=0 for all 958 records, every country's lastSeenAt
resolves to a single day), so the day-bucket grouping was inert in production
and introduced two artifacts: an 'undated' bucket that let timestamp-missing
threats add a second cap-8 of penalty (driving CN to 36 vs GB 68 purely on
data quality), and a multi-day-accumulation claim the feed cannot support.

Replace with a straight per-snapshot cap: weightedCount = min(total, 8).
Behaviorally identical for the (timestamp-less) fixtures, removes the artifact
and the dead firstSeenAt/lastSeenAt fields, and makes the tests/docs honest.

- summarizeCyber: total severity-weight cap, no day buckets
- tests: replace the fixture-only 'multi-day accumulates' test with floor-not-
  zero + volume-invariance tests that reflect the real feed
- docs/methodology: state plainly this is a per-snapshot cap, not smoothing;
  note the two paths to genuine burst-vs-sustained discrimination
- cache comments: 'per observed day' -> 'per snapshot' (v19 unchanged; not
  yet deployed, so no further bump needed)

Refs #3971

* fix(resilience): preserve reference capture provenance

* test(resilience): export cap constant; derive cyber burst-floor from it

Addresses Greptile P2 review comments on #4006:
- export CYBER_SNAPSHOT_WEIGHT_CAP so tests reference the constant (no
  literal-8 drift risk)
- replace the arbitrary <=25 delta bound with a deterministic, cap-derived
  burst-floor assertion (mild > burst, burst floors at (25-cap)/25*100)

Refs #3971