Add Mongo query-stats telemetry

[witbrock]

What changed

• add a bounded, redacted MongoDB $queryStats source to mongo_query_diagnostics_report
• include it in combined diagnostics and expose typed source status, freshness, and truncation metadata
• retain the last successful redacted snapshot for the existing cost-guardrail report
• expose the source through internal MCP schemas and the maintenance workflow
• prevent the diagnostic aggregation from recording itself as a slow query shape
• document capability, privilege, freshness, and Atlas reconciliation boundaries

Why

The existing in-process listener and system.profile surfaces could not reliably reproduce cluster-side high scanned-per-returned cases. $queryStats supplies the missing MongoDB-side counters without requiring Atlas Admin API access or profiler enablement.

Impact

Trusted operator diagnostics can now detect and rank high-scan query shapes directly from the configured MongoDB deployment. Reports remain read-only and omit literal query values, document bodies, credentials, and raw query-shape records. No indexes, database roles, profiler settings, or schedules are changed.

Validation

• 79 targeted tests passed
• fatal Ruff checks passed
• git diff --check passed
• live Atlas-backed $queryStats and combined-source reads succeeded
• live collection-specific read detected high scanned-per-returned shapes
• verified the diagnostic does not add itself to slow query-shape telemetry