get_ag_health caps its fleet-wide answer, most severe first, and says when it cut (#4471)

[erikdarlingdata]

Fixes #4471.

Why

get_ag_health's only parameter was server_name. A fleet-wide call (the tool's own description invites omitting it) returned every (reporting server, AG) group with no cap: a production fleet measured 265,794 characters, over an MCP client's typical per-result token limit, and got spilled to a file or refused outright. get_analysis_findings already carries the pattern this tool lacked — a limit with a stated default, most-severe-first ordering, and a truncation flag.

What changes

• get_ag_health (and the shared DarlingAgReader.GetAgHealthAsync/Build) gained a limit parameter, default 11, on the unit a caller reasons about: groups (one monitored server's view of one AG).
• Ordering is most-severe-first (unchanged), with a new tie-break for groups that share a severity: the largest secondary_lag_seconds or queue depth (KB) anywhere in the group. Lag and queue depth stay un-banded, by design (see the reader's own doc comment) — this tie-break only decides which same-severity groups a cut drops first, it never changes a group's severity.
• The envelope carries three new fields: groups_returned, groups_total, groups_truncated (+ groups_truncated_note when true), naming the same trio get_analysis_findings uses for its own findings_truncated. availability_group_count/distinct_ag_count/worst_severity still describe the WHOLE scope, not just the returned page.
• The /api/read/get_ag_health dispatch row and the API catalog gained the limit parameter to match; /api/ag (the dashboard's own read) is unchanged and stays uncapped — it renders its own page, not an MCP client's result buffer.
• Lite has no AG-health read (get_ag_health is Darling-only, per its own doc comment), so no Lite change was needed.

Test plan

Live Postgres pins in DarlingMcpAgToolsTests.cs (container rig, role darling on a Timescale image):

• AgHealth_DefaultLimitCapsMostSevereFirstAndFlagsTruncation_AgainstDevPostgres (new): seeds 42 HEALTHY single-replica groups plus one CRITICAL group (a suspended database) planted LAST by both insertion order and name, then asserts the default call (no limit argument) returns exactly 11 groups, groups_returned/groups_total/groups_truncated/groups_truncated_note are correct, and the critical group is first. Also asserts limit >= total clears the flag.
• All 6 pre-existing DarlingMcpAgToolsLivePostgresTests/DarlingMcpAgToolsSurfaceTests pins pass unchanged (the surface pin's expected parameter list was updated to server_name,limit).
• McpToolsListBudgetTests (5/5), McpToolGuideHeadsAgStoreTests (5/5), DocCommentHygieneTests (77/77), DarlingWebEndpointsTests (70/70), AvailabilityGroupCountReadTests, DarlingAgStatesReaderLiveEqualityTests, DarlingAgStatesReaderTests, PgTargetMcpSurfaceTests, DarlingCoreToolProfileTests — all green.
• RUNTIME RED on origin/dev (6f50c73b0): a throwaway test file, compiled clean on dev (it calls GetAgHealth with no limit argument, since dev's signature has none), seeded 15 groups on one server and called the tool with defaults — failed at runtime asserting <= 11 groups returned and groups_truncated == true, because dev returns all 15 uncapped with no such field. Removed after confirming.
• Mutations, both reverted: (1) commented out groups.Sort(CompareGroups) — the new severity-first pin went RED. (2) removed the limit cut (pagedGroups/groupsTruncated stayed unconditional) — the same pin went RED (no truncation, 43 groups back). Both reverted; the pin is GREEN again on the current branch (7/7 in the class).

Sizes (43-server / 3-AG-per-server / 2-replica / 3-database fixture, ~2.7 KB/group on this shape, via a throwaway harness against the built DLLs):

• Uncapped (limit set past the total, i.e. the old, unbounded behavior on this fixture): 348,187 characters.
• The fixed tool's own default call (no arguments, limit=11): 30,115 bytes — under the shared 32 KB budget. limit=12 measured 32,812 bytes, over it, which is why 11 is the largest default that clears the budget on this shape.

CHANGELOG entry

SECTION: Changed
ENTRY:

• get_ag_health returns at most 11 Availability Group views by default, the least healthy first, and says when more exist ([get_ag_health caps its fleet-wide answer, most severe first, and says when it cut (#4471) #4474]) - a fleet-wide call on a large fleet returned hundreds of kilobytes; scope by server_name or raise limit for the rest.
  REF:
  [get_ag_health caps its fleet-wide answer, most severe first, and says when it cut (#4471) #4474]: get_ag_health caps its fleet-wide answer, most severe first, and says when it cut (#4471) #4474