fix(precompute): enforce active window timestamps

[zzylol]

Closes #590.

Rejects observations outside the active timestamp-defined window before sketch mutation:

• zero allowed lateness now means zero grace;
• subtraction-based lateness checks avoid uint overflow;
• samples at/after the active end return typed ErrFutureData, allowing the host to rotate/catch up and retry rather than contaminating the old window;
• keyed and unkeyed paths share the same boundary validator.

Tests cover zero-lateness, the exact upper boundary, both ingestion paths, and verify rejected future data is absent from the closed window.

Stacked on #597.

[zzylol]

Follow-up review fix: future-window observations now rotate atomically, queue the closed envelopes for the next Tick/Drain, and retry admission in the correct window. This prevents both old-window contamination and the adapter-level drop that the first revision could cause.