feat(timeline): maintenance, reboots, deploys, crash-loops and reviewed anomalies on the timeline (#6349)

The host agent writes each maintenance job once it ends, and each stretch a
host was away (a reboot, a crash, lost contact, the agent restarting), kept up
to date until it is back. Docker judges each snapshot: a unit on a new image,
or a container recreated, is a deploy; deaths past the Thresholds crash-loop
count are one crash-loop entry that later deaths extend; single restarts are
recorded but hidden. An anomaly has one entry whose type follows its review:
only those judged real are shown by default.

A source whose record changes keeps one entry for it (record_or_update).
Plugins register the records their entries point to, so an aged-out job or
downtime reads "Details no longer kept". The first fill runs once per source
(timeline.filled), the host agent's jobs and downtime included.

get_anomaly's "what else was going on" reads the timeline for the host or
resource instead of querying alerts, runs, maintenance, downtime and container
deaths itself; Docker's own source keeps only starts, stops and health
changes. A new kind, Observed, is for what Steward saw happen with no rule or
person behind it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/timeline.py

@@ -12,9 +12,11 @@ async def get_timeline(host: str = "", area: str = "", kind: str = "", type: str
                        range: str = "7d", include_hidden: bool = False, limit: int = 50) -> dict:
     """What happened to the infrastructure, newest first, from every source in
     one list: alerts firing, resolving and going silent; playbook runs and
-    what they changed; changes to Steward's own settings, users and backups.
-    Each entry outlives the record it came from, so this reaches further back
-    than get_alert_history, list_ansible_runs or list_audit_events.
+    what they changed; maintenance runs, reboots and lost contact; deploys
+    and crash-loops; anomalies once reviewed as real; changes to Steward's
+    own settings, users and backups. Each entry outlives the record it came
+    from, so this reaches further back than get_alert_history,
+    list_ansible_runs or list_audit_events.
 
     Reach for it first for "what changed on this host lately?" or "what else
     was going on when this broke?". Follow an entry's `url` or ids into the
@@ -24,11 +26,13 @@ async def get_timeline(host: str = "", area: str = "", kind: str = "", type: str
     area: what part of the infrastructure an entry is about, as Settings →
       Timeline names its areas (`areas` in the reply lists them); empty for all.
     kind: how it came about: "change", "automation", "alert", "anomaly",
-      "ticket" or "steward"; empty for all.
+      "ticket", "observed" (seen happening: a reboot, a crash-loop) or
+      "steward"; empty for all.
     type: one entry type (`types` in the reply); it is returned even if hidden.
     range: "1h", "6h", "24h", "7d" (default) or "30d".
     include_hidden: also the types Settings hides from the timeline (dry runs,
-      sign-ins, playbook runs that changed nothing).
+      sign-ins, playbook runs that changed nothing, single container
+      restarts, anomalies not reviewed as real).
     limit: default 50, max 500.
     """
     if kind and kind not in catalog.KINDS: