Send new identity rule alerts to security on-call before gaps

Your identity rule events arrive unlabeled, causing delayed investigations and compliance gaps. Security on-call gets prioritized alerts with policy context to close incidents before SLAs lapse.