feat(alerts): run metrics investigations for platform-owned insight alerts - #127925

Problem

• A platform-owned metrics alert with the investigation flag on gets no metrics investigation when it starts firing.
• This layer adds it on top of the agent claim in #127923.

Changes

• A metrics alert's transition into firing gets the insight stack's metrics investigation. Its summary or error lands on an InsightAlertInvestigation row of kind metrics.
• It shares the agent's cooldown, as the insight stack does.
• The firing's delivery is held for up to 5 minutes, and released when the run ends or its claim is refused. The safety net sends it if nothing releases it.
• The hold also lets delivery drop the PagerDuty trigger of a firing that resolved while it waited.
• A released metrics firing keeps its own threshold breaches. Only the agent's verdict rewords a firing.
• The claim writes the row. A separate activity runs the metric queries afterwards, behind its own patch, so they never hold back an agent start.
• The run leases its row (PENDING to RUNNING), so a retry never runs the queries twice. The window is anchored on the firing's start.
• The run holds the evaluation's ClickHouse slot, and its slot wait and start count against the activity's deadline.
• The insight binding's evaluation timeout grows from 20 to 22 minutes to hold the new activity.

How did you test this code?

Test rationale: the source-cycle cases catch a metrics firing sent before its investigation, a run past its deadline, and a retried run that queries twice. The workflow case catches a delivery started before the release. The message case catches a metrics release that loses its breaches.

Ran the alerts, alerts platform and legacy metrics alert suites locally, and repo-wide mypy.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /writing-tests, /writing-code-comments, /writing-user-facing-copy, /stacking-prs, /reviewing-with-coderabbit, /simplify, /code-review, /writing-pr-descriptions

• No duplicate: no open PR builds the agent's platform path.
• Public artifact: nothing here comes from customer material.
• CI report, comment density: each added comment states a reason (a patch marker, an ordering constraint, or a failure path), so none were cut.
• CodeRabbit CLI: skipped. The CLI refused both runs (rate limit, then no assigned seat), so the bot's review on this PR is the CodeRabbit pass.

🤖 Generated with Claude Code