fix(alerts): previewing or testing a rule needs read scopes for its telemetry - #2507

🟢 Confidence 10/10 · safe to merge. A scope tightening whose mapping is unit-tested per branch and pinned over HTTP; the managed-signal and MCP paths are ruled out by reading them.
_{no findings · tests covered · risk high}

Gates the two v2 alert routes that run a rule's query and return what it measured behind the telemetry read scopes that query needs. The signal-to-family mapping is unit-tested branch by branch, refusals are pinned over HTTP without touching the warehouse, and the earlier findings on managed signals and the test endpoint are fixed.

• ruleReadFamilies maps each rule signal to the telemetry its query reads
• requireRuleReadScopes refuses preview and test with 403 before any query runs
• uptime and slo_burn_rate need no telemetry scopes; raw_query needs all three
• Both endpoint descriptions document the added read scopes

Fixed since the last review

• ✅ F2 · uptime and slo_burn_rate demand telemetry reads they never make
• ✅ F3 · The test endpoint's new scope gate is untested

_{4ca4b35 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}