[codex] refine alert cooldown scope

[stacknil]

Summary

• scope cooldown suppression by rule_name plus a simple entity key when entity columns are present
• keep the existing per-rule fallback when no entity-like column is available
• clarify the README wording and add a focused regression test for same-rule alerts across different sources

Validation

• pytest tests/test_rules.py
• pytest tests/test_pipeline_e2e.py -q
• pytest

Exact behavior

• cooldown key is (rule_name, scope)
• scope resolves from the first non-empty value among entity, source, target, or host
• when none of those columns exist, cooldown falls back to rule_name alone
• same rule_name with different scope values can both alert inside the same cooldown window
• same rule_name with the same resolved scope is still suppressed until the cooldown expires
• default bundled sample output stays at 12 alerts

Fixes #12

[stacknil]

@codex review
Focus on:

• whether cooldown keying by (rule_name, scope) is clear and internally consistent
• whether fallback to global rule_name-only cooldown is reasonable when no entity-like fields are present
• whether README wording matches the actual cooldown behavior
• whether PR [codex] refine alert cooldown scope #13 stays strictly within issue v0.3: make cooldown scoping more precise #12

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".