[vvoytovych]

Follow-up to #646, from its review. No workflow, Taskfile target or Makefile target runs test/alerts/test-*.sh, so neither test-shell-sessions.sh nor test-reconcile-storm.sh gates a PR. So a change to an alert's labels or expression can merge with its test red. This PR runs the tests in CI.

Summary

• task test:alerts runs every test/alerts/test-*.sh. It runs all of them, then fails if one failed, so one run shows every failing rule. Both tests run, and a new test joins by its file name.
• The Test Alerts workflow runs the task when a pull request or a push to main touches config/components/alerts/, test/alerts/, the workflow or Taskfile.yaml. It follows validate-dashboards.yaml: the same path filter, concurrency and setup-task step.
• Pinned tools. The job downloads promtool 3.16.0 and yq v4.54.3 and checks each against the SHA-256 that its release publishes. So the result does not change when the runner image changes.

Test plan

• The job's steps, run in a linux/amd64 ubuntu:24.04 container as the runner runs them, are green on main: both tests pass.
• The job is red on each planted failure. A label changed in the reconcile-storm rule: that test fails, and the next test still runs. The shell-session rules' team label changed: the test names the wrong service and team. A wrong promtool checksum: the install step fails.
• actionlint reports no problem.
• This PR's own Test Alerts run is green. The workflow file is in its own path filter, so the PR runs it.

Merge danger

A two-way door: a revert removes the job. The PR adds a check and changes no rule, test or build.

Related to #646

[ecv]

Approve.

Both alert-rule tests now run in CI on any change to an alert, its test, the workflow or the Taskfile. A label or expression change can no longer merge with its test red.

• The task runs every test/alerts/test-*.sh and fails at the end, so one run names every failing rule. With no test files, the unmatched glob makes bash fail, so the task does not pass on an empty set.
• promtool and yq are pinned and checked against their published SHA-256.

Follow-ups:

• The workflow is path-filtered, so it cannot be a required check as written. A required check stays pending on PRs it skips. If it should block merges, add an always-run job that reports success when nothing under the filter changed.