dx_evidence_graph: viz stub — coordination with dx-agent data model

[ConstanzeTU]

Summary (draft / stub)

Coordination placeholder for a new Pixie UI dashboard that replaces the
latency-weighted HTTP service map in cluster_overview with a
severity-weighted, all-protocol pod-to-pod graph built from
dx-agent evidence.

• Display spec: vispb.Graph (same primitive as net_flow_graph),
  with edgeWeightColumn=weight and edgeColorColumn=weight.
• Nodes = pods. Edges = any observed pod→pod hop (HTTP / gRPC / DNS /
  Kafka / MySQL / PgSQL / raw TCP) via conn_stats — protocol-agnostic.
• Edge weight = severity contribution from dx evidence whose pod
  participates in the edge.

No runnable code lands in this PR yet. It exists so the dx-agent
work-in-progress and this viz work can converge on a schema before
either side ships.

What's in the diff

• src/pxl_scripts/px/dx_evidence_graph/README.md — the live contract:
  proposed evidence-row schema, two-path migration plan, five open
  decisions.
• dx_evidence_graph.pxl — stub with TODO markers pointing at the
  README.
• vis.json — stub displaySpec wired to placeholder columns.

Two-path migration

	Path B — v1	Path A — v2
Evidence source	Script arg evidence_csv	dx_evidence Pixie table
Pixie changes	None	New source connector (or AE sink)
dx changes	URL-template the evidence list	Push rows to Pixie ingest
Time-to-ship	1–2 days once decisions settle	3–5 days after v1 validates the visual

Forward-compatible: the contract in the README matches both paths.

Open decisions — please weigh in (dx-agent ↔ pixie)

#	Question	Default I'd pick
1	Edge severity inheritance: A→B with only B flagged — full / half / zero?	full
2	Time anchor: relative to evidence.T ± window, or free-form?	anchor ± 2 min, free-form fallback
3	Hop depth cap from the evidence pod?	2 ("pod-to-pod-to-pod" = neighbourhood-of-2)
4	Multi-evidence aggregation on one edge?	sum for weight, max for colour
5	Script placement — upstream or private dx/scripts/?	upstream (this PR)

Open questions for dx-agent

• Is severity stable across kubescape rule revisions, or do we need
  a per-criterion normaliser?
• Evidence emitted per upid (process) or per pod (rollup)?
• Per-vectors.Finding rows or per-Diagnosis chains? Latter needs a
  diagnosis_id foreign key.
• For Path A v2: how does dx push into Pixie's table-store — new
  Stirling source connector, the AE adaptive_export sink, or
  standalone-pem's data-ingestion gRPC?

Test plan

• dx-agent reviews the schema contract in README.md
• Decisions 1–5 settled; defaults overridden in README.md if dx-agent disagrees
• v1 implementation lands on this branch (PxL + vis.json filled in, draft flipped to ready-for-review)
• Manual test: load script via Pixie UI on the lab cluster, verify graph renders for a sample evidence row
• Follow-up PR for Path A once v1 has been used on a real incident

Type of change

/kind feature