fix: reduce false alerts and unblock incident resolves - #585

Behaviour

• Lease: with a Running and Ready holder, LeaseStale needs kwatch to have seen that holder renew and then stop. Findings for an unhealthy holder are unchanged.
• Unused claim: the 24h clock starts when kwatch first sees the claim without a mount (last unmount, or start-up), not from the phase. Claims named by a CronJob pod template are skipped; CronJobs now reference those claims.
• Warnings on healthy custom resources: Ready=True with no failing condition counts as recovered from its transition time. Unusual events ignore Warnings older than recovery, for every kind readySince covers; newer ones still count.
• Blocked resolves: a kind that is only over an object cap is judged per object. Refused objects, unsynced kinds and lost access still hold. A held incident gets one timeline note and rechecks every minute, because sight can return with no finding change.
• Watch budget: kyverno.io and its subgroups rank as operators; reports.kyverno.io stays in the custom tier.

Limits

• The renewal marker is in memory: after a kwatch restart a healthy holder must be seen renewing again.
• A refused root stays held until a cap frees room for it.