fix: render {{ $labels.X }} in alert summaries

The Ops alert list took summary/description from the rule-level
annotations, which are raw Go templates, and only substituted
{{ $value }}. A rule like "PIA VPN tunnel is down on {{ $labels.job }}"
showed the template literally.

- One active instance: use the annotations Grafana already rendered for it.
- Several: fill each {{ $labels.X }} with the distinct values across the
  active instances ("a-job, b-job"), "?" if none has the label.
- The description gets the same treatment (it was never substituted).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012T5EBQfEofzrZbp3aTiMku

libexec/devdesk-ops.sh

@@ -163,6 +163,17 @@ cmd_alerts() {
     fi
     jq -cM --arg pub "$DEVDESK_GRAFANA_PUBLIC_URL" --slurpfile g <(cat "$DEVDESK_GUESTS" 2>/dev/null || echo null) "$DD_LOCATE_JQ"'
         def num: (tonumber? // .) | tostring;
+        # Rule-level annotations are raw Go templates. Fill {{ $labels.X }} with the
+        # distinct values across the active instances and {{ $value }} with the first.
+        def fill($t; $active):
+            reduce ([$t | scan("\\{\\{ *\\$labels\\.([A-Za-z_][A-Za-z0-9_]*) *\\}\\}") | .[0]] | unique[]) as $k
+                ($t; ([$active[] | .labels[$k] // empty] | unique | join(", ")) as $v
+                     | gsub("\\{\\{ *\\$labels\\.\($k) *\\}\\}"; if $v == "" then "?" else $v end))
+            | gsub("\\{\\{ *\\$value *\\}\\}"; ($active[0].value // "?" | num));
+        # One active instance: Grafana already rendered its annotations, use them as is.
+        def annotation($key; $t; $active):
+            if ($active | length) == 1 and (($active[0].annotations // {})[$key] // "") != ""
+            then $active[0].annotations[$key] else fill($t; $active) end;
         ($g[0]) as $guests
         | {configured: true, checked: (now | floor), pve: ($guests != null), alerts: [
             .data.groups[] | .name as $group | .file as $folder | .rules[]
@@ -171,9 +182,10 @@ cmd_alerts() {
             | {uid, name, state, severity: (.labels.severity // null), group: $group, folder: $folder,
                query: (.query // null),
                since: (.activeAt // $active[0].activeAt // null),
-               summary: ((.annotations.summary // .annotations.description // "")
-                         | gsub("\\{\\{ *\\$value *\\}\\}"; ($active[0].value // "?" | num))),
-               description: (if .annotations.summary then (.annotations.description // null) else null end),
+               summary: (if .annotations.summary then annotation("summary"; .annotations.summary; $active)
+                         else annotation("description"; .annotations.description // ""; $active) end),
+               description: (if .annotations.summary and .annotations.description
+                             then annotation("description"; .annotations.description; $active) else null end),
                labelsets: [$active[] | .labels
                             | del(.__alert_rule_uid__, .__grafana_origin__, .alertname, .grafana_folder, .__name__, .severity)
                             | select(length > 0)],