[hoalongnatsu]

What does this PR do?

Adds Logs at break to Kubernetes Timeline so responders can compare logs,
changes, and crashes in the same incident window. A per-cluster Agent tab
provides optional log-source linking and saved learning preferences marked as
preview, with no runtime learning effect.

• Timeline investigation: drag the log-window bracket, compare per-minute
  log volume and errors, and use Logs before crash to inspect available
  previous-container output for the selected termination.
• Find useful messages: filter by Pod, container mode, severity, and search;
  review repeated message patterns, source labels, and coverage tips.
• Keep captured evidence: automatically capture bounded container logs at
  detected breaks. Captured logs survive Pod deletion and Versus restarts for
  up to 24 hours, subject to capture, storage, and retention limits; not every
  line or crash is guaranteed to be captured.
• Optional linked history: link one configured Loki, Elasticsearch,
  CloudWatch Logs, Graylog, Splunk, or SigNoz source per cluster. Map workload
  fields, use Test link, and save with settings-write permission. A
  successful preview does not guarantee complete incident history.
• Investigation handoff: Ask chat carries the workload and selected
  window; Open live logs opens a bounded recent workload snapshot with
  refresh, not a continuously streaming tail or automated remediation.
• Agent preview: save logs, metrics, and traces learning toggles and
  namespace scope per cluster without changing runtime learning behavior.

Why?

Container logs can disappear after repeated restarts or Pod deletion, leaving
responders to reconstruct a failure from disconnected views. Bringing captured
logs and explicit coverage limits into Timeline helps operators compare evidence
without treating missing logs or nearby changes as proof of a cause.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (config / API / default behavior)
• Documentation only
• Refactor (no functional change)
• CI / build / chore

Checklist

• go test ./... passes locally
• go vet ./... is clean
• Added or updated tests for the change
• Updated user-facing docs under src/ if behavior changes
• Updated ROADMAP.md if this closes a roadmap item
• No secrets, tokens, or webhook URLs introduced in source / YAML
• No new third-party dependencies (or justified in the description)