fix(issues): preserve honest onset provenance

[nadaverell]

Summary

• distinguish evidence-backed active time from resource creation and unknown snapshot timing
• propagate condition, event, threshold, and tracker timestamps only when they support the current failure
• expose grouped uncertainty without emitting redundant all-known coverage
• describe first_seen as “active at least since,” never exact onset, across API docs, MCP, and UI
• reject CEL age filters when any logical branch can treat unknown first_seen=0 as 1970
• keep owner-condition timing explicitly workload-level and separate from a row's own active-time anchor

Fleet validation

• compared binaries from main and this branch across all configured clusters
• 17 of 23 clusters were reachable; AWS, GCP, and kind environments were represented
• zero issue membership, severity, reason, message, cause, action, or top-200 ordering differences
• 17,025 timing/provenance field differences, which is the intended surface of this PR
• all-known grouped coverage is now omitted; on radar-test-prod, 0 of the first 1,000 rows carry redundant all-known coverage

Validation

• make test
• make tsc
• make build
• 34 focused issue UI tests
• focused issue, filter, MCP catalog, and schema tests
• Cursor Opus cross-review, findings fixed, convergence review clean
• live EKS run against radar-test-prod (3,200 issues): API/UI healthy, zero browser console errors
• live unsafe disjunctive first_seen filter rejected with HTTP 400 and actionable guidance; guarded filter returned HTTP 200
• Playwright verified health regressed, active at least …, and the owner-workload attribution caveat in the production build

Risk and rollback

This is a broad read-path change: issue membership and diagnosis are unchanged, but timing fields are consumed by the UI, MCP agents, and CEL filters. Unknown onset is now explicit, and previously unguarded first_seen age filters fail loudly instead of returning misleading matches. Reverting this PR restores the prior timing behavior.

Follow-up to RAD-346.

---

Note

Medium Risk
Broad read-path change to timing fields used by the UI, MCP agents, and CEL filters; issue membership is unchanged but clients must handle unknown onset and stricter filter validation.

Overview
Issue timing is now evidence-backed end-to-end: first_seen is set only from explicit anchors (OnsetAt, condition lastTransitionTime, deletion time, trackers, etc.), not from resource age or compose-time guesses. Missing anchors surface as onset_unknown with resource_created_at kept as separate context, and grouped rows can carry onset_coverage when members disagree on whether onset is known.

Detectors and condition sources were updated to pass parsed transition times (including CAPI, Velero, Helm, gateway routes, CNPG) and to mark unknown onset when timestamps are absent or in the future. setDetectionOnset centralizes duration/OnsetUnknown derivation; problem normalization no longer fabricates onset from AgeSeconds/DurationSeconds.

Aggregation behavior uses foldIssueOnset for grouping and duplicate-env rollups, sorts unknown-onset issues by resource creation via issueSortAnchor, drops symptom→structural issue_timing donation, and clears group-wide timing when onset coverage is mixed. Public timestamps are normalized to UTC before filters run.

Consumers: MCP/docs describe first_seen as “active at least since”; CEL issue filters gain onset_unknown, onset_coverage_unknown, and resource_created_at, with compile-time rejection of age filters that use first_seen without guarding unknown onset (first_seen != 0, !onset_unknown, etc.).

^{Reviewed by Cursor Bugbot for commit 8a266b3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 04d2b62. Configure here.}