feat(alerts): persist alert events from stored metric and release observations

[CrisSTEM]

Summary

Add a first persisted alert-evaluation runtime that reads stored observations from SQLite and materializes derived alert_events for supported rule families.

Linked issue(s)

• Closes feat(alerts): persist delta detections and release/activity alert events from stored observations #48

Milestone fit

This PR advances v0.4.0 by turning persisted metric snapshots and stored release observations into auditable alert rows without relying on transient fetch responses.

It intentionally keeps alert delivery, dashboard views, candidate-suggestion processing, and documentation reconciliation out of scope for this issue.

What changed

• added a new internal/alerts runtime that evaluates enabled alert rules from persisted SQLite observations
• implemented metric-based alert evaluation for:
  • absolute_change_gte
  • percent_change_gte
• implemented event-based alert evaluation for:
  • event_key = "release.published"
  • condition.type = "silence_then_event"
• persisted derived alerts into alert_events with copied rule context, severity, timestamps, summaries, and auditable JSON payloads
• added rerun-safe suppression so unchanged evidence does not create endless duplicate alert rows
• added deterministic tests for:
  • positive metric alert scenarios
  • negative metric alert scenarios
  • positive release-after-silence scenarios
  • negative release scenarios
  • rerun duplicate suppression
  • explicitly deferred unsupported event-rule handling

Out of scope

• email / Slack / webhook delivery
• dashboard alert views
• advanced anomaly detection
• social / app-store alert families
• dismissal / resolution workflows
• news.co_mention / candidate_repeat_gte processing and candidate_suggestions
• documentation reconciliation, which is intentionally deferred to the dedicated end-of-milestone docs issue

Validation

Mark what you actually ran:

• python3 ./scripts/trim-whitespace.py --check
• go vet ./...
• go test ./...
• make ci
• Manual CLI verification was performed if runtime behavior changed

Documentation impact

• No docs update needed
• README.md
• SPEC.md
• docs/
• repository governance docs (AGENTS.md, CONTRIBUTING.md)
• CHANGELOG.md
• release notes

Documentation reconciliation for alert/runtime notes is intentionally deferred to the dedicated end-of-milestone docs issue.

Reviewer focus

Call out the highest-risk files, behaviors, or assumptions to review.

• internal/alerts/runtime.go
• internal/alerts/runtime_test.go
• rerun-safe duplicate suppression based on persisted open alert rows plus stream identity in payload JSON
• release-stream grouping that uses persisted release metadata (repository) when available
• unsupported event-rule handling that stays explicit instead of implying broader alert-family support

Auditability checklist

• Branch name follows project convention
• PR scope matches the linked issue and milestone
• Commits were pushed progressively, not as one final dump
• Relevant tests were added or updated for behavior changes
• No secrets or sensitive credentials were introduced
• Deferred follow-up work is documented explicitly
• Unimplemented work is not implied as completed

Notes for merge

Preferred merge method:

• Issue PRs: Rebase and merge
• Release aggregation PRs: Merge commit
• Use Squash and merge only when the branch became noisy and preserving intermediate commits no longer adds value