[EPAC-2285]: Assert application-level 404 for unknown bill diff in staging smoke

[riddim-developer-bot]

Scope

Completes the staging-smoke half of EPAC-2285 by adding the one deterministic assertion the issue's risk note calls out as "the regression that created the current miss": distinguishing an API Gateway route-missing 404 ({"message":"Not Found"}) from the bills service's own application-level 404 for an unknown bill/version.

The rest of EPAC-2285 already landed on main via the sibling EPAC-2288 (PR #812): the GET /api/v1/bills/{id}/diff route in the staging+production manifest, the OpenAPI↔manifest parity guard in check_backend_manifest_deployment.py, and the bills:diff-route / bills:diff-full smoke checks. EPAC-2288's bills:diff-route only exercises the missing-parameter HTTP 400 path, so the application-level 404 path was never driven by a default-mode check.

This PR adds bills:diff-unknown:

• GET /api/v1/bills/ZZ-9999/diff?from=v1&to=v2 — an unknown bill id with from/to present, so the bills Lambda reaches lookupBillID, returns ErrBillNotFound, and the handler responds 404 {"error":"bill not found"} before any version/diff lookup. No backfilled diff data is required, so it runs in default contract mode.
• The validator fails on the API Gateway 404, requires a service-owned error body (proving the request reached the Lambda), asserts the 404 is a documented not-found message, and tolerates a warming 503.
• service="bills", default mode (not full_only), so it runs in both staging and production smoke whenever bills is deployed. It mirrors the existing riding-boundary:unknown-slug negative-check pattern.

Acceptance criteria

Criterion	Status
Manifest declares GET /api/v1/bills/{id}/diff for bills (staging + production)	Met on main (EPAC-2288)
OpenAPI aligned (route, id/from/to, 200/204/400/404/429/500/503)	Met on main (EPAC-2288)
Deployment checker fails when the route is missing from API Gateway	Met on main (EPAC-2288, with tests)
Staging smoke includes a deterministic bill diff assertion	bills:diff-route (existing) + bills:diff-unknown (this PR) — completes the API-Gateway-404-vs-app-404 distinction
Production has equivalent route sync/readiness coverage	bills:diff-unknown is default-mode for bills, run by backend-production.yml
Existing backend smoke checks continue to pass	Yes — 65 tests pass; no other check changed

DoD — "the staging smoke contract would have failed on the current API Gateway 404 state": both bills:diff-route and the new bills:diff-unknown fail on {"message":"Not Found"} via is_api_gateway_not_found.

Bugfix SPEC

• Spec: EPAC-2285 — Linear implementation issue (not a bug-intake SPEC).
• Trace ID: N/A

Testing notes

• Automated tests run:
  • python3 -m pytest scripts/ci/tests scripts/ci/test_backend_staging_smoke.py scripts/ci/test_ios_coverage_report.py → 65 passed (exact pr-build.yml invocation; +2 new validator tests).
  • python3 scripts/ci/backend_staging_smoke.py --list | grep bills:diff confirms bills:diff-unknown [bills] runs in default contract mode (no [full] marker), alongside bills:diff-route.
• Manual verification: Traced the handler contract in backend/bills/main.go (mapBillVersionDiffError) and internal/usecase/bills.go / adapter/sqlite/repository.go (lookupBillID → ErrBillNotFound for an unknown bill via sql.ErrNoRows) to confirm an unknown bill id deterministically yields a service-owned 404 before any version/diff data is needed.
• Skipped checks: Live staging/production smoke requests were not run locally — they require deployed AWS API state. The backend-staging.yml / backend-production.yml workflows run the smoke (default contract mode) and the manifest deployment checker against live infrastructure on deploy.

Screenshots

N/A — backend CI / smoke-test change, no UI surface.

Related issue

• Closes: EPAC-2285

Release-Note: N/A — CI smoke-test coverage only; no user-facing change.