feat(workflow): Mustache lambda helpers for missing-key defaults (fn.*)

[hakatt]

Summary

Closes #5682. Also addresses the root cause of #5070 and is a lighter-weight alternative to the Jinja migration requested in #4594.

Injects a set of named lambda helpers into every Chevron render context so workflow templates can safely reference custom or enriched alert fields that may be absent — without triggering RenderException:

# Empty or missing → "N/A"
body: "Panel: {{#fn.na}}{{ alert.panelUrl }}{{/fn.na}}"

# Empty or missing → ""
if: "{{#fn.default}}{{ alert.slack_timestamp }}{{/fn.default}}"

# Transform
body: "Severity: {{#fn.upper}}{{ alert.severity }}{{/fn.upper}}"

Changes

Backend keep/iohandler/iohandler.py (+23 lines):

• WORKFLOW_HELPERS constant with fn.{default,na,upper,lower,strip} Chevron lambdas
• Merged into context on every _render() call
• Safe mode auto-disabled when template contains {{#fn. (lambda already returns a safe default, so RenderException must not be raised)

Frontend keep-ui/entities/workflows/lib/mustache.ts (+3 lines):

• Filter Mustache sigil tokens (#, /, ^, !, >) from extractMustacheVariables() so the workflow builder doesn't flag {{#fn.na}}/{{/fn.na}} as invalid variable references

Design rationale

See #5682 for the full two-category analysis. The short version:

• Provider schema fields (e.g. panelUrl, instance) → defaulted in _format_alert(), no workflow-layer handling needed
• Custom/enriched fields (e.g. slack_timestamp from enrich_alert, optional labels) → no provider can default these; fn.* helpers give workflow authors a clean per-field default syntax

This does not change behaviour for any existing workflow that does not use {{#fn. sections.

Test plan

• Unit test: fn.na on missing key → "N/A"
• Unit test: fn.default on missing key → ""
• Unit test: fn.upper/fn.lower/fn.strip on present value
• Frontend: open workflow builder with {{#fn.na}}{{ alert.x }}{{/fn.na}} — no "invalid variable" warning
• End-to-end: all five helpers (fn.default, fn.na, fn.upper, fn.lower, fn.strip) validated on dev Keep 0.49.0-svt.10 — workflows run without RenderException

[vercel]

@nflx is attempting to deploy a commit to the KeepHQ Team on Vercel.

A member of the Team first needs to authorize it.

[shahargl]

@hakatt @nflx is this active?

[nflx]

@hakatt @nflx is this active?

Yes, we have it running well in our test environment and I will just finish writing the unit tests and rebase it. Thank you for the reminder @shahargl :-)

[greptile-apps]

Target branch is not in the allowed branches list.

[hakatt]

PR ready, (if accepted).