feat(alerts): silences match an anomaly incident's service and environment - #2319

🟢 Confidence 10/10 · safe to merge. Silence matching gains one optional label source threaded through all five lookup sites, pinned by unit and PGlite integration tests.
_{no findings · tests covered · risk medium}

Anomaly incidents now store the service and environment they are about in a new labels_json column, and the silence matcher consults those labels before the group key and rule scope, so a services: ["checkout"] silence mutes checkout anomalies. Labels are threaded through every silence lookup and exposed on the incident document, v2 wire, web-data and MCP outputs; safe to merge.

• alert_incidents.labels_json records an incident's service/environment; anomaly incidents set it at open
• scopedServices/scopedEnvironments prefer target.labels over group key and rule scope
• findActiveSilence takes labels at open, reminders, catch-up and both auto-resolve paths
• labels added to the incident document, v2 incident, web-data row decoding and MCP outputs

Before merge

• Migration · Check it is safe on production data and with the code still deployed · packages/db/drizzle/20261106180930_alert_incident_labels/migration.sql
• Migration · Check it is safe on production data and with the code still deployed · packages/db/drizzle/20261106203611_merge_incident_labels_escalation_lease/migration.sql

_{6b56451 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}