fix(alerts): resolve last-event grouping and document its rollout

[rvald26]

The alert plugin receives events[] on the wire but queries documents indexed with lastEvent. Directly looking up lastEvent on the wire drops those grouping keys. This draft resolves values from the final wire event while retaining the indexed query paths, and shares query-term construction between grouping and deduplication. Non-scalar or missing values cannot trigger a name-only search.

This is a runtime grouping change across technologies. A reproducible inventory pinned to v11 commit 660c796f168670fd6ccb079995c09c46d4f0068d identifies 231 rule files with lastEvent keys (309 occurrences, 126 distinct paths), plus all other configured grouping keys. These are potential query changes, not 231 proven live activations. See plugins/alerts/audits/grouping-rollout.md for the separate pending rollout plan.

Tests use real SDK alerts and BoolBuilder terms to verify final-event values, indexed lastEvent paths, array selectors, .keyword suffix handling, numeric zero/boolean false and missing/non-scalar values. The full alerts module passes locally. Query tests do not contact customer indices or prove deployed index mapping behavior.

The reusable filter contract harness remains included as a separate testing facility. It decodes against pinned go-sdk v1.1.31 and evaluates real CEL. Synthetic normalization is explicitly labeled. New opt-in raw JSON fixtures use SDK key sanitization and reject unsupported executed parser/functions; this is an offline model, not the closed EventProcessor. Optional all-branch placeholder checks do not execute history searches. A fixture without rule assertions proves no detection.

Before rollout: compare the same ordered stream against equivalent isolated alert indices, measure per-rule candidate/saved/suppressed/parent counts, inspect partial/missing identities and active deployed rule/mapping versions, and approve expected changes. These staging and volume checks remain pending. Technology drafts using lastEvent grouping depend on this runtime fix.

Draft only, targeting official utmstack/UTMStack v11. No customer writes, deployment, merge, auto-merge or SOC messages were performed.

Fresh draft review submission requested after review of #2590. That earlier PR is retained as historical context and was not modified by this publication. This PR targets the official utmstack/UTMStack:v11; it is not approved for merge.

The schema checker also recognizes whole temporary Draft namespaces only when the final step unconditionally deletes them; children of known schema namespaces are never exempted. Azure checks strict final protobuf decoding separately. The completed draft set on v11 a121490 now passes 2,027 test records with nine documented private/reference skips and no failures; the source-specific private checks run separately. This test-only refinement adds no runtime behavior change.