fix(sidekiq): keep environment label on concurrency limit alerts

What

Keep the environment label on two Sidekiq concurrency-limit alerts so their dashboard links work, and make SidekiqWorkerThrottledByDBUsage match real series.

Closes gitlab-com/gl-infra/tenant-scale/tenant-services/team#522 (closed) Parent: gitlab-com/gl-infra/tenant-scale/tenant-services/team#521 (closed)

Why

SidekiqConcurrencyLimitQueueBacklogged aggregated with max by (worker). That drops environment, but grafana_variables: 'environment,worker' renders var-environment={{ $labels.environment }} into the dashboard link. The link opened the Worker Concurrency Detail dashboard with var-environment= empty, so every panel showed no data. The alert is firing right now for Ci::ExecuteBuildHooksWorker.

Confirmed in Mimir gprd before this change: ALERTS{alertname="SidekiqConcurrencyLimitQueueBacklogged"} carried only worker, alert_type, severity, pager.

SidekiqWorkerThrottledByDBUsage had literal Grafana variables ($environment, $stage, $worker) in its PromQL, copied from the dashboard panel, and ignored extraSelector. It could never match a series.

Changes

• SidekiqConcurrencyLimitQueueBacklogged: max by (environment, worker).
• SidekiqWorkerThrottledByDBUsage: sum by (environment, worker, strategy) over sidekiq_throttling_events_total{<tenant selector>, type="sidekiq", strategy="HardThrottle"}.
• Regenerated mimir-rules/gitlab-gprd and mimir-rules/gitlab-gstg sidekiq alert files.

Verification

Ran the generated gprd expressions as instant queries against Mimir gprd on 2026-10-13:

• topk(5, max by (environment, worker) (max_over_time(sidekiq_concurrency_limit_queue_jobs{env="gprd"}[5m]))) returns series labelled environment="gprd", top value Ci::SyncReportsToReportApprovalRulesWorker at 417285.
• count(sidekiq_throttling_events_total{env="gprd",strategy="HardThrottle",type="sidekiq"}) returns 17. The old selector returned nothing.
• make validate-prom-rules, make test-jsonnet and make validate-mimir-rules pass locally.

Rollout

Rules deploy from ops.gitlab.net on merge. Alert cardinality is unchanged: every series already has exactly one environment per tenant.