fix(alerts): the signal-event rules count the host, not the data point

[rldyourmnd]

The OTel signal-event streams carry a start_time label that changes with each counter run, so an expression that does not aggregate returns one series per run rather than one per host. Three rules read those streams and none aggregated: alert_evaluation_failed, audit_suppression_burst, kernel_workqueue_hog.

Measured on 2026-09-02: sixteen failed alert evaluations in two minutes reached the channel as three series of 4, 4 and 3 — three identical pages for one incident, re-sent every eleven minutes for the hour the window remembers. The same arithmetic under-counts in the other direction: three failures spread across three runs sum to one each and never cross the threshold, and in the two cumulative rules a counter that restarts hides half its increase.

All three now sum by (host_name), which is also the label the notification prints as its subject, so the count is the host's and each host produces one message. A walking test refuses any signal-event rule that does not aggregate; the sustained-delta test now asserts the property (no outer subquery, no or, no scalar collapse, delta summed by host) instead of matching a literal prefix.

Audited the same way against a live query: every other rule already groups by host_name, scale_set or error_class.

https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp