fix(mcp): get_anomaly shows a quick Steward restart, not only a gap over 90 s (#5862)

A redeploy's new process ticks at once, so its once-a-minute samples never
broke for 90 s and get_anomaly showed none of the day's restarts. The first
self-monitor tick in a process now records restart_gap_secs (time since the
last process's last sample), and steward_gaps shows each one as a restart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/core/alerting.md

@@ -138,6 +138,7 @@ failed agent posts, a gap in watching, or open files near the limit.
 | `ingest_slowest_ms` | The slowest post in the last minute; agents give up at 10 s |
 | `db_roundtrip_ms` | A `SELECT 1`, connection checkout included |
 | `unwatched_secs` | The gap before this tick when it exceeds `watch.GAP_S` (a deploy or an outage); 0 when unbroken |
+| `restart_gap_secs` | Recorded once, on a new process's first tick: the time since the last process's last sample, however short |
 | `cleanup_secs` | How long the last hourly retention and rollup run took |
 | `open_fds` / `open_fds_pct` | Steward's open files, and as a share of its limit (absent without `/proc`) |
 

docs/plugins/writing-a-plugin.md

@@ -408,7 +408,7 @@ async def mcp_events(db, host_id, host_name, since, until) -> list[dict]:
 
 A resource with no host (a Traefik router, say) has no host to read events by. A plugin that knows what happened to one of its own resources exports `mcp_resource_events(db, source, resource, since, until)` instead, same return shape, and returns `[]` for a source that isn't its own. Traefik's is the example: it gives a router's swarm service's container events, on whichever hosts they ran.
 
-Core adds, beside every anomaly, the stretches Steward itself wasn't recording (kind `"steward"`: a restart, a deploy, a stall), read from its own once-a-minute health sample. A plugin doesn't need to report those.
+Core adds, beside every anomaly, the stretches Steward itself wasn't recording (kind `"steward"`: a restart, a deploy, a stall), read from its own once-a-minute health sample; a restart is shown however quick, from the `restart_gap_secs` its new process records. A plugin doesn't need to report those.
 
 ---