feat(alerts): one evaluation path; host-agent ingest fires rules (#5060)

#5060 "One evaluation path: record_metrics batch API; host-agent ingest
evaluates rules".

- record_metrics(session, rows) writes metric rows and evaluates the rules
  that watch them, reading rules, states and maintenance windows once per
  batch. Each rule sees its key's samples oldest first, so an agent catching
  up after an outage counts consecutive checks as they happened.
- Host-agent ingest now goes through it. Before, it wrote plugin_metrics
  directly and no host_agent rule could ever fire. The catalog gains the
  per-mount disk_used_pct ("<host>:<mount>").
- MetricBatch gathers a transaction's samples; the docker ingest, traefik,
  unifi, snmp, monitor and self-monitor writers record one batch each instead
  of a rule query per sample.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/routes.py

@@ -201,6 +201,7 @@ async def ingest():
             return _error(401, "invalid_token")
 
         accepted = 0
+        metric_rows: list[PluginMetric] = []
         latest_ts: datetime | None = None
         docker_snapshots: list[tuple[datetime, list]] = []
         docker_log_batches: list[tuple[datetime, list]] = []
@@ -213,9 +214,7 @@ async def ingest():
                 recorded_at = _parse_ts(sample["ts"])
             except (KeyError, ValueError):
                 continue
-            metrics = _expand_sample_to_metrics(sample, host.name, recorded_at)
-            for m in metrics:
-                session.add(m)
+            metric_rows.extend(_expand_sample_to_metrics(sample, host.name, recorded_at))
             docker = sample.get("docker")
             if isinstance(docker, list) and docker:
                 docker_snapshots.append((recorded_at, docker))
@@ -243,6 +242,10 @@ async def ingest():
             await session.rollback()
             return _error(400, "malformed_payload", "no valid samples")
 
+        # Through the alert pipeline, so rules on host metrics can fire.
+        from steward.core.alerts import record_metrics
+        await record_metrics(session, metric_rows)
+
         # Hand host-scoped container data to the docker plugin if it's enabled
         # (opportunistic synergy via the capability registry — no hard import,
         # no-op when docker is disabled). A failure here must never sink the