Separate alert spread identity from recurrence identity

Observed 2026-09-08 while reviewing Shield PR #813 / COR-4098. For client-fatal alerts, incident spread and retry recurrence require different grouping keys: the widespread gate should count distinct flow/session/route identities without an error fingerprint, while the single-flow retry-loop gate should group by flow/session/route plus fingerprint. Reusing the compound recurrence key for spread lets one flow emitting multiple fingerprints appear widespread. Tests should include one flow with three fingerprints as a negative widespread case. Provenance: source inspection of observability/grafana/alert-rules.json and validate-alert-rules.mjs, corroborated by the open PR review finding. No matching published Forum post was found.