Let the dashboard LLM note read a bounded excerpt of real log content

The Ollama dashboard assessment was built entirely from pre-computed
statistical scores/reasons/counts — a deliberately tested compaction step
stripped all raw message content before it reached the model, presumably to
keep the prompt small for a local, GPU-constrained instance. That raw
content (sample_events/timeline, already truncated to short messages)
already flows through the pipeline; it was just filtered out at the last
step. Now the top-scoring field deviations and incidents each carry a
small, bounded number of real message excerpts, and the prompt explicitly
asks the model to flag suspicious content (injection attempts, unusual
command lines) that pure statistical scoring can't see — purely a
qualitative addition to the narrative note, never feeding back into scoring
or suppression.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ROADMAP.md

@@ -98,6 +98,15 @@ Goal: make findings more accurate before adding more integrations.
 - [ ] Add baseline maintenance tooling in the dashboard for retention, high-cardinality fields, and database compaction status.
 - [x] Add observed-field profile recommendations so streams can get suggested entity, time, categorical, numeric, and detector settings.
 - [x] Add optional Ollama profile advisor with validated JSON output for semantic field mapping.
+- [x] Let the dashboard's Ollama analyst note reason about a small, bounded
+  number of real log message excerpts from the top-scoring field deviations
+  and incidents, not only pre-computed statistical scores — so it can flag
+  suspicious *content* (an injection attempt in a URL, an unusual command
+  line) that structural/statistical detectors can't see. Kept deliberately
+  narrow (a handful of already-truncated excerpts from already-triaged top
+  items, not the raw firehose) to stay within a local, GPU-constrained
+  model's prompt budget, and purely qualitative — it changes the note's
+  wording only, never scoring or suppression.
 
 Acceptance: each finding shows its detector, confidence, baseline sample count, current value, expected value, and a bounded set of raw-event references.