fix: make NewValueComboDetector use every configured combination

[viktorbeck98]

Task

No issue.

Description

NewValueComboDetector only trained and checked the first instance of each event. Auto-config writes one instance per combo, in the order the variables arrive, and logFormatVariables (a protobuf map) has no fixed order. So one random combo per event was monitored and results changed between runs.

• All instances of an event are now trained and checked. A log missing one of an instance's variables is skipped for that instance.
• Variables and combos are sorted before the config is written.
• VariableDetector gets an _event_variables hook for this. Other detectors are unchanged.

More combos are monitored than before, so expect more alerts. A log can now score above 1, and events_until_save counts once per combo.

How Has This Been Tested?

• 5 new tests, including a federation round trip. Full suite passes.
• 24 benchmark cells, 3 runs each, give identical results. Before, 5 of the 24 differed between runs.

Checklist

• This Pull-Request goes to the development branch.
• I have successfully run prek locally.
• I have added tests to cover my changes.
• I have linked the issue-id to the task-description.
• I have performed a self-review of my own code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}