Multi-window burn rate, and the two alerts it replaces

A single burn-rate window is either too twitchy or too slow, and pairing a long window with a short one gives both sensitivity and stability.

# page: fast burn, confirmed by a short window
- alert: FastBurn
  expr: burn_rate_1h > 14.4 and burn_rate_5m > 14.4

# ticket: slow burn, over a long window
- alert: SlowBurn
  expr: burn_rate_6h > 6 and burn_rate_30m > 6

# the short window is what makes it RESET quickly once fixed

The short window in the conjunction is doing the resetting rather than the detecting: without it, a one-hour burn rate stays elevated for an hour after the incident is resolved and the alert keeps firing at somebody who has already fixed it. Two severities from the same mechanism is the other benefit — a fast burn is a page and a slow one is a ticket, and both are the same arithmetic.