Function detectTreasuryBreaches

Counts backing- and float-breach metrics strictly newer than sinceExclusive; any hit fires (there is no threshold to tune — a breached backing invariant is always an incident), none returns null. newestAt is the caller's next watermark.