When is_clearly_healthy() trips, _handle_healthy_finding built the
validated_claims list by iterating every evidence key and filtering by
truthiness. Two problems fall out of that:

1. Query-string metadata (grafana_logs_query, datadog_logs_query), counts
   (eks_total_pods, datadog_monitors_count), and other non-data fields are
   truthy and leak into the findings as e.g.
       "datadog_logs_query data confirmed within normal operating bounds"
   which is nonsensical — that field is a query, not data.

2. An empty grafana_logs/eks_events list after a completed investigation is
   itself the healthy signal (per is_clearly_healthy's docstring and
   condition 4), but an empty list is falsy and silently dropped, so the
   claim that actually triggered the short-circuit never appears.

Iterate _INVESTIGATED_EVIDENCE_KEYS intersected with evidence.keys() (the
same gating is_clearly_healthy uses) and sort for deterministic output.

E2E validated on the synthetic healthy scenarios
(HEALTHY_SHORT_CIRCUIT=true, mocked backends, real Anthropic LLM for the
upstream graph steps):

  tests/synthetic/eks/000-healthy        passed, findings trimmed from
                                          8 claims (4 noise) to 5 clean
                                          claims; eks_events: [] now
                                          surfaces as a healthy claim
                                          instead of being dropped.
  tests/synthetic/rds_postgres/000-healthy passed, efficiency_score=1.0.

Unit coverage added (24 tests): empty-list produces a claim, non-
investigation keys stay out, order is deterministic, every investigation
key is recognised (parametrized), and diagnose_root_cause short-circuits
without invoking the LLM.

Follow-up to address two completeness concerns with the previous commit.

1. **Back-compat for truthy non-investigation data keys.**  The previous
   revision iterated only ``INVESTIGATED_EVIDENCE_KEYS``, which silently
   dropped claims for truthy evidence entries like ``datadog_events``,
   ``datadog_error_logs``, ``honeycomb_traces``, ``eks_failing_pods``, and
   similar adjacent data keys written by the investigate mappers.

   Claim generation now unions two rules:

   - Investigation keys present in evidence always produce a claim (empty
     lists included — mirrors ``is_clearly_healthy`` condition 4).
   - Other evidence keys produce a claim when they carry non-empty data
     *and* do not match a metadata shape (query string, count, timing,
     resource name, total, by-pipeline aggregate).

   Metadata is detected via ``str.endswith`` on a small suffix tuple
   (``_query``, ``_count``, ``_ms``, ``_source``, ``_name``, ``_namespace``,
   ``_total``, ``_by_pipeline``), plus ``total_`` prefix and ``_total_``
   infix for keys like ``eks_total_pods`` / ``lambda_total_logs``. Strict
   ``endswith`` avoids false positives like ``grafana_service_names``
   (plural — list of service names, real data).

2. **Rename ``_INVESTIGATED_EVIDENCE_KEYS`` to ``INVESTIGATED_EVIDENCE_KEYS``.**
   The set is now imported from another module in this package, so the
   leading underscore is misleading. Public name matches its actual API
   surface. Internal references in ``evidence_checker.py`` and the two
   test modules updated in the same commit.

Coverage additions (91 tests total across the two test modules, up from
the previous 24):

- ``TestTruthyNonInvestigationDataClaims`` parametrised over 18 adjacent
  data keys — confirms the union rule keeps them as claims.
- ``TestMetadataKeyFiltering`` parametrised over 22 metadata shapes —
  confirms queries, counts, totals, timings, and resource names are
  excluded even when the adjacent investigation key is also present.
- Forward-compat test: a new ``my_new_source_data`` key not in the
  investigation set is claimed automatically once populated by any
  future mapper, without a code change.

E2E re-validated with real Anthropic LLM for upstream graph:

- ``tests/synthetic/eks/000-healthy`` — short-circuit still hits at 0ms,
  5 clean claims (``datadog_logs``, ``datadog_monitors``, ``eks_deployments``,
  ``eks_events``, ``eks_pods``). Scenario passed.
- ``tests/synthetic/eks/001-oomkilled-crashloop`` — non-healthy path,
  full LLM investigation runs (2× diagnose, 192s total), produces the
  expected OOM/SIGKILL root cause with confidence scores. Scenario
  passed, ``category=resource_exhaustion``. Confirms the change does
  not leak into the non-healthy branch.

Verification:

- ``pytest tests/``: 2834 pass, 1 skipped, 0 failures.
- ``ruff check`` and ``ruff format --check``: clean.
- ``mypy app/``: unchanged pre-existing pymysql-stub warnings only.