Slack alert titles render "on <no value>" for alerts without a host label #3081

🤖 Generated by the Agentic Engineer

Evidence. Alertmanager's Slack receiver builds its title as ... {{ .CommonLabels.alertname }} on {{ .CommonLabels.host }}. host is a node-agent label, so any alert that is not node-scoped renders a dangling clause. Measured by running the exact rendered template through Go's text/template:

• node-agent alert → [FIRING] KubescapeRuleViolated on worker-1
• hostless alert → [FIRING] CrossplaneManagedResourceNotSynced on <no value>

Who it affects. Anyone reading #platform-alerts. It is live now: the crossplane-sync-alerter added in #3080 posts cluster-scoped alerts with no host, and any future non-node alert on this catch-all route inherits the same title.

Expected. The clause is omitted when the label is absent, and node-agent titles are unchanged.

Acceptance criteria.

• Guard the label ({{ with .CommonLabels.host }} on {{ . }}{{ end }} renders correctly in both cases — verified).
• Re-approve the moved EKS authorization fingerprints, and say in the PR why a Slack title moved them.
• Existing node-agent titles are byte-identical.

Why it is not folded into #3080. The Alertmanager HelmRelease sits inside the EKS authorization surface — isControllerRBACEmitter pins the whole release, because a chart's values can change RBAC — so this one-line cosmetic change moves an approved fingerprint. Re-approving a security pin deserves its own review rather than riding along in an alerting PR (the same re-approval discipline d365ad0 followed).

Size. Small: one template line plus the fingerprint re-approval.