[Alerting V2] Agent Builder: get_rule_events tool for episode attachments

[ana-davydova]

Summary

Adds an attachment-scoped get_rule_events tool so Agent Builder can fetch .rule-events rows for an attached platform alert episode (breaches, recoveries, timing) without stuffing the full timeline into the snapshot.

Fetch path: get_rule_events → EpisodesClient.getEvents → shared buildEpisodeEventsQuery (same query as the episode details timeline).

• Tool id: platform.alerting.get_rule_events.{attachmentId}
• Episode id is closed over from the attachment (not a free-form argument)
• Privilege: Alerts: Read
• Call with no arguments to fetch this episode’s events; optional start/end (together) to narrow @timestamp, optional status for lifecycle (inactive | pending | active | recovering)
• Result: { events, count, truncated } — data is kept and parsed to an object; at most 100 rows (LIMIT 101, return 100); truncated is true only when more than 100 rows exist
• Projected fields: @timestamp, episode.id, episode.status, rule.id, group_hash, severity, source, data (source added to the shared KEEP; no evaluation status / type)

Closes elastic/rna-program#938 (parent elastic/rna-program#712).

Test plan

• Jest: episode_events_query, episodes_client, get_rule_events, episode_attachment_type
• Open a platform alert episode, open Agent Builder, confirm get_rule_events is listed next to refresh_episode and get_rule
• Call the tool with {} and confirm events for that episode (oldest first), with object data and truncated: false when under 100 rows
• Pass start/end together and confirm the window is applied; passing only one returns an error
• Pass status: "active" (not episode.status) and confirm the lifecycle filter is applied
• Confirm Alerts: Read is required; unauthorized users get the privilege error result
• Confirm a missing episode returns not-found; get() failures log AGENT_BUILDER_EPISODE_LOOKUP_FAILED separately from GET_RULE_EVENTS_FAILED

[kibanamachine]

PR size reminder

This PR has 820 added lines of reviewable code, which is above the 500-line guideline for Nightshift PRs.

Large PRs get significantly less review engagement and take longer to merge. Consider splitting this into smaller, focused PRs before requesting review.

[dmlemeshko]

src/platform/test/tsconfig.json changes lgtm

[kibanamachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 1499dce
• Build duration: 81 mins

Failed CI Steps

• FTR Configs #66
• FTR Configs #126
• Serverless Rule Management - Prebuilt Rules Upgrade - Security Solution Cypress Tests #1

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
alertingVTwo	861.1KB	861.5KB	+464.0B

Unknown metric groups

total optimizer output size

id	before	after	diff
all	63.9MB	63.9MB	+464.0B

History

• 💛 Build #499857 was flaky 9875e43
• 💔 Build #498743 failed 19314b7
• 💛 Build #495810 was flaky ec43165
• 💛 Build #495537 was flaky b76dbb5
• 💔 Build #495435 failed 0f24ce8

[miguelmartin-elastic]

LGTM! Thanks for addressing the comments