fix(mcp): get_anomaly keeps the events nearest the occurrence and says how many it left out (#5861)

Each source in an anomaly's `around` was cut to its oldest 40 with
nothing in the reply to say so; on a busy host the events nearest the
occurrence were the ones dropped. Each source now keeps the 40 nearest
the occurrence's start, and `around_left_out` counts the rest. Sources
return everything their bounded query read (Docker and the host agent
no longer cut at 40 and 20 themselves), so the count is honest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/mcp/test_anomaly_review.py

@@ -119,6 +119,16 @@ def test_a_plugin_adds_a_hostless_resources_events_through_its_hook(app):
         mcp.resource_event_sources.pop("events_test", None)
 
 
+def test_a_busy_window_keeps_the_events_nearest_the_occurrence_and_counts_the_rest():
+    """#5861: 50 container events over an hour; the occurrence starts at :45."""
+    evs = [_events.event(NOW + timedelta(minutes=m), "container", f"c{m} start") for m in range(50)]
+    kept, cut = _events.nearest(evs, NOW + timedelta(minutes=45))
+    assert len(kept) == 40 and cut == 10
+    assert {e["what"] for e in kept} >= {"c45 start", "c49 start", "c20 start"}
+    assert "c0 start" not in {e["what"] for e in kept}
+    assert _events.nearest(evs[:5], NOW) == (evs[:5], 0)
+
+
 def test_steward_not_recording_is_an_event_beside_every_anomaly():
     """A Steward restart between two of its once-a-minute samples (#5862)."""
     ticks = [NOW + timedelta(minutes=m) for m in (0, 1, 2)] + [NOW + timedelta(minutes=4, seconds=10)]