add value-shape field classification and auto-apply

Field roles are now inferred from observed values instead of names,
with src/dst disambiguation, value-pattern detector hints, an Ollama
advisor scoped to ambiguous fields only, confidence-gated auto-apply
with manual-field protection, and drift flagging for review

src/fgai/replay.py

@@ -2,11 +2,11 @@ from __future__ import annotations
 
 import tempfile
 from collections import Counter, defaultdict
-from datetime import datetime
 from pathlib import Path
 
 from .anomaly import anomaly_summary, detect_source_anomalies
 from .baseline import BaselineStore
+from .field_shapes import parse_iso_timestamp
 from .models import LogEvent
 
 
@@ -32,10 +32,8 @@ def _timestamp(event: LogEvent, fallback: int) -> int:
     try:
         return int(float(value))
     except (TypeError, ValueError):
-        try:
-            return int(datetime.fromisoformat(str(value).replace("Z", "+00:00")).timestamp())
-        except ValueError:
-            return fallback
+        parsed = parse_iso_timestamp(value)
+        return int(parsed) if parsed is not None else fallback
 
 
 def _with_stream(events: list[LogEvent], stream_id: str, stream_name: str) -> list[LogEvent]: