The #2412 alarm files an issue when upstream CC is >2 releases past latest_known.
Two candidate dedup keys behaved very differently under a persisting lag. The workflow-agent draft keyed on
latest_known; the first shipped version keyed on the upstream head. This simulator shows why
the agent's design won (this PR adopts it). Each click = one daily cron tick during an unhealed lag where
upstream publishes a release that day.