fix(alerts): guard anomaly tick resolves and lease escalation claims - #2315

🟢 Confidence 10/10 · safe to merge. The only change since the last review is the regenerated snapshot, which chains to alert_silences and carries both new columns.
_{no findings · tests covered · risk high}

Guards the anomaly tick's resolves and turns escalation dispatch into a leased, attempts-fenced claim. The change since the last review is only the regenerated escalation_claim_lease snapshot, which is now correct.

• Anomaly tick resolves are CAS'd on reopenCount/lastTriggeredAt
• Escalation claims take a claimed_at lease fenced by attempts

Before merge

• Migration · Check it is safe on production data and with the code still deployed · packages/db/drizzle/20261106194851_escalation_claim_lease/migration.sql
• Manual · Roll every alerting worker out together: a claim from an old worker leaves claimed_at null and can be claimed twice in that window

_{be4a14b · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}