Trigger checks and increment alert counters for sandbox

Sandbox alerts are split across sub-workflows, causing missed thresholds and unclear incident history for on-call staff. It increments counters and triggers threshold checks so engineers act same day.