Promote 'even-split' note to a prominent warning when it dominates

[willwashburn]

Context

`burn waste` today prints its attribution method caveat as a footer note just under the totals line, e.g.:

```
turns analyzed: 64,117
session grand total: $2772.33
attributed to tool calls: $645.94 / unattributed (output, system overhead, untracked): $2126.38
note: 39486/39587 sessions used even-split (no content sidecar).
```

The note is accurate but reads as an edge case. In practice — on my local ledger when I first ran this — 99.7% of sessions were in even-split mode. A reader who skims past the note will happily compare the per-file / per-bash / per-subagent dollar figures across sessions without realizing that the vast majority of those figures are rough approximations from dividing turn N+1's new-content cost evenly among turn N's tool calls, not the sized attribution the header strongly implies.

#58 lands real content capture for codex and opencode, so for most users going forward the dominant-even-split state will only appear briefly during the transition. But the mechanism itself — a legitimately approximate mode being reported as a footnote — is wrong independent of any single cause. It'll recur the next time someone adds a new adapter without content capture, or when retention prunes a large swath of sidecars, or when ingestion runs under `RELAYBURN_CONTENT_STORE=hash-only`.

Proposed behavior

When even-split sessions are ≥ 50% of the matched set, promote the note from a footer to a prominent banner above the tables, and soften the language on the attributed-dollar line so readers don't walk away with a false-precision number.

Current

```
turns analyzed: 64,117
session grand total: $2772.33
attributed to tool calls: $645.94 / unattributed (output, system overhead, untracked): $2126.38
note: 39486/39587 sessions used even-split (no content sidecar).

Top files by cumulative cost
...
```

Proposed when even-split ≥ 50%

```
turns analyzed: 64,117
session grand total: $2772.33

⚠ attribution is degraded: 39,486 of 39,587 sessions (99.7%) have no content
sidecar, so file / bash / subagent costs for those sessions are approximate
(even-split over turn N+1 input/cacheCreate). Run 'burn rebuild --content'
to backfill sidecars from source session files, or see 'burn content' for
why capture is disabled.

attributed ≈ $645.94 (approximate — see above)
unattributed $2126.38 (output, system overhead, untracked)

Top files by cumulative cost (approximate)
...
```

Thresholds:

• ≥ 50% even-split: banner + "approximate" qualifier on attributed lines and table headings.
• < 50% but > 0%: keep the current footer note; no qualifier on dollar lines.
• 0% (all sized): silent.

The 50% cutoff is where "sized is the tail" flips to "even-split is the tail." Could be tunable via a flag (`--warn-even-split-threshold=0.5`) but not required for v1.

Why this matters

• Dollar rankings across sessions are only meaningful when attribution methods are consistent. Ranking a sized session's files against an even-split session's files is apples to oranges and the report doesn't say so.
• Users will run `burn waste --project X` against a project whose sessions happen to be mostly codex and walk away with numbers that silently use the rough heuristic. Today there's no way to tell from the output unless you parse the footer.
• The banner doubles as discoverability for `burn rebuild --content` (added in Add content capture for Codex and OpenCode parsers (#33 follow-up) #58), which most users won't find otherwise.

Implementation sketch

In `packages/cli/src/commands/waste.ts`, the block at ~L84-L94 decides the note text. Refactor:

```ts
const degraded = evenSplitSessions.length >= result.sessionTotals.length * 0.5;
if (degraded) {
// Banner before tables, plus "approximate" qualifier on the attributed line
// and "(approximate)" suffix on each table's heading.
} else if (evenSplitSessions.length > 0) {
// Current footer note, unchanged.
}
```

Plumb `degraded` into:

• `out.push('attributed...')` → append `" (approximate — see above)"` when degraded.
• `out.push('Top files by cumulative cost' + (degraded ? ' (approximate)' : ''))`
• Same for Top Bash, Top subagents headings.
• JSON output (when `--json`): add `attributionDegraded: boolean` alongside `sessions[]` so programmatic consumers can branch without re-deriving from `attributionMethod` counts.

Acceptance

• Banner renders above the tables when even-split sessions ≥ 50% of matched sessions.
• "(approximate)" suffix appears on attributed line and every table heading in degraded mode.
• Silent on fully-sized ledgers; current footer note on partially-degraded (< 50%) ledgers.
• `--json` exposes a `attributionDegraded: boolean` so `burn waste --json | jq` pipelines don't have to reverse-engineer it from the session list.
• Snapshot tests for all three states (all sized / partial / degraded).
• Banner message references `burn rebuild --content` as the first-line remediation.

Out of scope

• Per-file / per-bash marking of which specific rows are from even-split vs sized sessions. Would be useful but the table widths don't accommodate another column. Could be a `--json` enrichment only.
• Changing the underlying attribution math. Even-split is documented as approximate in the code comments already; this issue is purely about surfacing that fact.