docs(adr-001): event-driven anomaly example using SubLinear primitives

[ruvnet]

Summary

Adds `examples/event_driven_anomaly.rs` — the canonical RuView / Cognitum inner-loop demo using every SubLinear primitive shipped in this session (#26–#32). Other repos can grep this for the pattern.

What it demonstrates

1. Build a 256-node strict-DD ring-stencil network (`nnz ≈ 1280`).
2. Compute baseline `x_prev = A⁻¹·b_prev` once (89 µs, Linear, one-shot).
3. Stream 5 single-sensor events as sparse RHS deltas.
4. For each event:
   • `closure_indices` over `delta.indices` at depth 4 → 17 rows
   • `solve_on_change_sublinear` over the closure (no `n`-scan)
   • `contrastive_solve_on_change_sublinear` for top-3 anomalies

Sample output

```
event closure latency_us top_anomaly score
──────────────────────────────────────────────────────────────────────────
sensor #42 spike 17 1102 42 0.2520
sensor #117 drift 17 1026 117 0.0672
sensor #200 spike 17 1046 200 0.3528
sensor #7 dropout 17 1891 7 0.5391
sensor #155 outlier 17 1436 155 0.5460
```

Architectural property holds:

• Closure size (17 rows) is independent of `n=256`.
• Each event resolves in ~1-2 ms regardless of perturbation site.
• Top anomaly is correctly identified at every perturbation point.

This is the runnable proof that ADR-001's "wake on event, never scan n" claim is real working code.

Run

```bash
cargo run --release --example event_driven_anomaly
```

Test plan

• `cargo run --release --example event_driven_anomaly` succeeds + prints expected output
• Full CI

🤖 Generated with claude-flow