feat(investigations): Create agentic runs from both entry points

[billyvg]

This changes the metric issue and the new investigation entry points so that they create the new agentic style investigation (e.g. the one w/ the hypothesis).

Slop

Neither entry point produced an investigation with hypotheses. The server decides from the request body — a source with no templateKey builds an agentic run, anything else builds a plain notebook — and both buttons sent a shape that landed elsewhere.

"Investigate" on a metric issue now sends the metric snapshot alone, dropping the template key. The candidates endpoint already matches agentic and template lineage keys alike, so a breach that was investigated before still resolves to "View" rather than offering a duplicate.

"New investigation" sends a manual source. That run opens awaiting_input and stays there until someone supplies a prompt, which nothing in the UI does yet, so the investigation behaves as before — an empty notebook — with an idle run attached.

That idle run is why polling changed. The predicate asked whether a run had reached a terminal status, and awaiting_input has not; left alone, every newly created investigation would have polled the detail and orchestration endpoints every two seconds forever. It now asks whether the agent is advancing, which awaiting_input is not: it is blocked on a person, and supplying input writes the new projection into the cache and starts it again.

Note that this does not gate the behaviour behind anything beyond the existing organizations:investigations flag — every investigation created in a flagged org becomes agentic.

Base branch

This targets billyvong/investigations-hypothesis-ui (#124086) rather than master: it edits static/app/views/investigations/hypotheses/investigationHypotheses.tsx, which only exists on that branch. It was originally committed there and reverted so that PR could stay focused; this is that commit, cherry-picked.

Visual verification

Blocked, and not skipped silently: this change lives in the request body sent when an investigation is created, so exercising it needs a local backend to create against. devservices is not running (Docker daemon is down), and the only other reachable API is production, which is not a valid QA target. Screenshots from the Storybook fixture API would not be evidence of this change, since the fixtures do not exercise the creation path.

Happy to capture the real states if devservices gets brought up.

Checks

• pnpm run typecheck clean
• pnpm run lint:js clean
• 621 tests pass across static/app/views/investigations/ and static/app/views/detectors/

https://claude.ai/code/session_014zh69vex76pjNTnarqVcXL

[github-actions]

Story previews

Preview the stories changed in this PR on the Vercel deployment:

• app/views/investigations/detail/index.stories.tsx
• app/views/investigations/hypotheses/hypotheses.stories.tsx

_{Preview deployment: https://sentry-ly1xh2lud.sentry.dev}

[billyvg]

bugbot review

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 881b0dd. Configure here.}