[Epic]: Per-BU cost attribution and chargeback reporting

## Summary
Build the BU-rollup and reporting/chargeback surface on top of the existing per-person µ$ budget enforcement, so finance and BU owners can see and act on AI spend by cost centre — including real-time threshold alerting, not just historical reporting.

## Intent / Source of truth
98% of FinOps practitioners now manage AI spend (up from 31% two years ago). Buyers expect per-developer (not headcount-divided) attribution mapped to an HRIS team taxonomy, with showback/chargeback export by cost centre. This is the highest-leverage epic in M5 — the enforcement primitive already exists (ai-helm ADR-0021/0035, per-person µ$ budgets and plan tiers via BackendTrafficPolicy); this epic is purely the reporting and rollup surface on top of it.

## Scope
- [ ] BU rollup model aggregating per-person spend up the org hierarchy
- [ ] Chargeback/showback export by cost centre (CSV/API, finance-tool-compatible format)
- [ ] Real-time budget-threshold alerting (before a limit is crossed, not after)
- [ ] Cost-centre mapping import from an HRIS taxonomy

## Out of scope
- Changing the underlying budget-enforcement mechanism itself (already done, per ai-helm ADR-0021/0035) — this epic is reporting/rollup only
- Building a general-purpose FinOps platform beyond AI spend

## Verification
A BU rollup total reconciles exactly against the sum of its members' per-person spend; a chargeback export imports cleanly into a sample finance tool format; a threshold alert fires before, not after, a budget is exhausted.

## Risk assessment
Depends on the organization hierarchy epic for the BU rollup structure — sequence accordingly. A rollup that silently diverges from the underlying per-person ledger would undermine trust in the whole chargeback feature; needs a reconciliation check, not just a display layer.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

Start by reading ai-helm ADR-0021/0035 and the existing BackendTrafficPolicy enforcement context, then account for the dependency on the organization hierarchy epic. Done means BU totals reconcile with members' per-person spend, chargeback exports import into a sample finance-tool format, and threshold alerts fire before budgets are exhausted.

Written by the indexing model from the issue text.