Lite Level 1: agent routes, investigation requests and the pull, claim and report tools in Lite #5820

Claude posting for Erik Darling.

Follow-up to #5632 Phase A (PR #5819), named in its plan. Phase A gives Darling's notification routes an agent level, stores one investigation request per server, alert family and 30-minute window, and serves the pull, claim and report tools over MCP. Lite has none of it: its routes share the matcher and its order (the NotificationRouteCategoryLevelTests pin covers both products), and the route field parity test lists the five agent fields as the one Darling-only exception.

What Lite needs for Level 1

• The five agent route fields (level, per-hour and per-day limits, lease and expiry minutes) on Lite routes, in its route window and its DuckDB config.
• Investigation requests, alert links, reports and the journal in DuckDB, with the same state rules: one open-or-join per window, one conditional claim with at most 3 claims, a submit that a newer claim supersedes, an expiry sweep that never reopens a lease.
• The pull, claim and report MCP tools with the same names and shapes as Darling's, so one agent works against either product.
• The mcp.dataDetail masking on Lite's tool answers.

Not in scope: anything beyond Level 1 (no agent actions), and no change to Lite's existing routes when the agent level is empty.

Part of the #5632 follow-ups: this one, the {{investigation_json}} webhook token, and MCP push.