fix(mcp): read the successes once, so every failed run is checked against all of them (#5842)

still_failing was handed the query's one-pass result. The first failed
run's any() consumed it, so a second failure in the window found no
successes left and was reported though a later run had put it right
(ci-runner-volumes came back once keepalived-survey also had a failure).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/mcp/test_tools.py

@@ -214,6 +214,15 @@ def test_a_failed_run_put_right_since_is_not_a_finding():
                                                 _run(S, 40, playbook="upkeep/y.yml"), _run(S, 70)]) == [real_fail]
 
 
+def test_every_failure_is_checked_against_every_success_even_from_a_one_pass_result():
+    """The live miss: a query result is an iterator, and the first failure's
+    check used it up, so a second failure was never cleared."""
+    F, S = AnsibleRunStatus.failed, AnsibleRunStatus.success
+    a, b = _run(F, 60, check=True, playbook="upkeep/a.yml"), _run(F, 50, check=True, playbook="upkeep/b.yml")
+    successes = iter([_run(S, 45, check=True, playbook="upkeep/b.yml"), _run(S, 55, check=True, playbook="upkeep/a.yml")])
+    assert overview.still_failing([b, a], successes) == []
+
+
 def test_rank_puts_critical_first_then_oldest():
     fs = [overview.finding("warning", "k", "w-old", "", since=NOW - timedelta(days=1)),
           overview.finding("critical", "k", "c-new", "", since=NOW - timedelta(minutes=1)),