[hoalongnatsu]

What does this PR do?

Brings logs from the linked data source into Kubernetes break investigations,
alongside bounded crash excerpts. Operators can open a break immediately and
see available logs fill in as the source catches up, without changing their
selected occurrence or investigation window.

• One break, one log view: combine captured and linked lines in time order,
  remove duplicates, and keep logs tied to the correct Pod and container run.
• Smooth arrival of delayed logs: show pending coverage and retry
  automatically for up to five minutes. Reopening starts a fresh retry window.
  Distinguish delayed, missing and budget-limited evidence.
• Simple source settings: use built-in ingestion delays for supported log
  sources, with an optional override in Kubernetes agent settings.
• Useful evidence after restart: retain bounded settled linked excerpts so
  the same break can be reopened even after the source is unlinked.
• Clear crash context: preserve OOMKilled causes and captured output as
  containers restart, rather than attributing later output to an earlier crash.
• Reliable selection and access: keep recurring break times stable and
  check current Kubernetes permissions before serving stored evidence. Report
  denied access and invalid credentials explicitly.

This adds bounded break evidence, not continuous container-log storage or a new
learning worker. Existing data-source configuration remains the source of truth
for linked logs; capture and query limits keep resource use bounded.

Why?

A log source may not have received the relevant lines when a break is first
detected. Fetching only at that instant leaves investigations incomplete, while
persisting every streamed log line consumes unnecessary disk.

Operators need the selected break's evidence to improve as logs arrive, remain
usable after restarts, and explain genuine gaps without silently switching
occurrences or showing an empty result as complete.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (config / API / default behavior)
• Documentation only
• Refactor (no functional change)
• CI / build / chore

Checklist

• go test ./... passes locally on the final whole-module snapshot
• go vet is clean in recorded affected-package validation
• Added or updated tests for the change
• Updated user-facing docs under src/ for changed behavior
• Updated ROADMAP.md if this closes a roadmap item
• No secrets, tokens, or webhook URLs introduced in source / YAML
• No new third-party dependencies