[vvoytovych]

A dead-letter alert takes its service and team from the failing policy's owner, so a policy that declares no owner alerts with no service, which no route reaches, and the alert lands in the catch-all channel, as identity policies did in both environments over the last two weeks.

Such an alert now falls back to activity's own owner, the control plane service and the platform team, as the platform's catalog names the owner of the namespace activity runs in.

A policy that declares an owner keeps it, so its failures still reach its own team.

Changes

Change	Effect
The five policy alerts	fall back to the control plane service and the platform team when the policy declares no owner
The alert for failed dead-letter publishes	names the same owner
The alert tests	expect the fallback for policies without an owner, and keep the declared owner for those with one

Test plan

• The alert tests fail on the previous fallback and pass on this one, and a declared owner is kept
• Routed through both environments' live alert trees, the fallback reaches the platform team's channel and a declared owner reaches its own
• After the release reaches production, the next alert for a policy without an owner posts to the platform team's channel
• For a week after the release, no activity policy alert reaches the catch-all channel in either environment

[ecv]

Approve.

Dead-letter alerts for a policy with no declared owner now go to the platform team's channel instead of the catch-all. A policy with an owner keeps routing to its own team.

• In the unless branch the series has no policy_service, so label_replace(..., "service", "$1", "policy_service", "(.*)") sets service to empty. That drops any scrape-time service label, so the template's control-plane fallback is what lands, not the Kubernetes Service name.
• The tests cover both the fallback and a declared owner.