Ingester: account for duplicate samples silently dropped at TSDB commit

[dmatth1]

What this PR does

The TSDB head appender silently drops samples whose timestamp collides with an already-stored sample: exact duplicates (client retries, duplicate shippers, Kafka replay after an ingester restart) and same-timestamp conflicts that are only detectable at commit time. Append returns no error for these, so the ingester counted them as ingested and recorded no discard — making ingestion impossible to reconcile with what senders report.

After a successful commit, the ingester now reads tsdb.CommitStats from the appender (added in grafana/mimir-prometheus#1259) and reclassifies the drops:

• cortex_discarded_samples_total gains reason same-value-for-timestamp (exact duplicates); commit-time conflicts count into the existing new-value-for-timestamp.
• cortex_ingester_ingested_samples_total no longer counts the dropped samples (it now reflects what was actually stored).
• The drops are attributed per series in cost attribution.
• Dropped duplicates still refresh the TSDB last-update timestamp, so duplicate-only traffic does not idle-close the tenant TSDB.

The stats capability is part of extendedAppender, so an appender wrapper that fails to forward it breaks loudly on the first push instead of silently zeroing the accounting.

Notes for reviewers:

• The vendor/ commit is mechanical — review the TSDB side in tsdb: report CommitStats including duplicate samples dropped at commit time mimir-prometheus#1259. It currently pins that PR's branch (62700c08baf5) and will be dropped (or re-pinned to fork main) once Revise mimirtool docs #1259 merges. Do not merge before tsdb: report CommitStats including duplicate samples dropped at commit time mimir-prometheus#1259.
• cortex_ingester_ingested_samples_total changes meaning from Append-time counting to post-commit truth (see CHANGELOG [CHANGE]); the only mixin consumer is the ingest-activity guard in the MimirIngesterHasNotShippedBlocks* alerts, which this makes marginally more accurate.
• In-order histogram exact-duplicates are no longer miscounted as prometheus_tsdb_out_of_order_samples_total (vendored change).

Validated end-to-end on a local ingest-storage cluster and on a classic-architecture dev cell: per-scenario discard accounting, first-value-wins storage, identical counts across zones, and the Kafka-replay restart path.

Which issue(s) this PR fixes or relates to

Fixes #15552

Checklist

• Tests updated (pkg/ingester/ingester_push_duplicate_test.go — scenarios by @duricanikolic — plus TSDB-level coverage in tsdb: report CommitStats including duplicate samples dropped at commit time mimir-prometheus#1259).
• CHANGELOG.md updated.
• Documentation added (runbook: duplicate-timestamp section).

Co-authored with @duricanikolic (design + prototype + tests).

🤖 Generated with Claude Code

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

💻 Deploy preview available (Mimir):

• https://deploy-preview-mimir-16347-zb444pucvq-vp.a.run.app/docs/mimir/next/