fix(intune): sort timeline by datetime and expand failed AppWorkload context

[adamgell]

Summary

• Intune Diagnostics events now sort across all loaded files by datetime, not just within each file
• Root cause: parse_timestamp() in timeline.rs didn't handle RFC 3339 format (2024-01-15T10:30:00.000Z) produced by the IME parser's timestamp_utc field. All events got None timestamps, causing the sort to fall back to the source_file tiebreaker and group events by file instead of interleaving by time
• Sorting fix: Added chrono::DateTime::parse_from_rfc3339() as a fallback in parse_timestamp()
• AppWorkload follow-up: Failed and timed-out AppWorkload rows now include a much larger bounded context bundle built from the current subgraph plus nearby same-GUID lines, so users can see the full failure story instead of a single line
• Added a Copy error + context action on expanded timeline rows so users can copy the error metadata and collected context to the clipboard
• Added regression coverage for RFC 3339 parsing/cross-file sorting and the failed-event clipboard action

Test plan

• npx vitest run src/components/intune/EventTimelineRow.test.tsx src/stores/intune-store.test.ts
• npx tsc --noEmit
• Rust tests in this sandbox are currently blocked by missing glib-2.0 / pkg-config
• Manual: load multiple IME log files in Intune Diagnostics, verify events interleave by datetime across files
• Manual: select a failed AppWorkload row, confirm expanded context includes surrounding app evidence and Copy error + context copies the full payload

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes Intune Diagnostics timeline ordering so events interleave correctly across multiple loaded IME log files by ensuring RFC 3339 timestamps (e.g. 2024-01-15T10:30:00.000Z) are parsed into usable datetimes for global sorting.

Changes:

• Extend parse_timestamp() to fall back to chrono::DateTime::parse_from_rfc3339() and convert to UTC.
• Add regression tests for RFC 3339 parsing (with Z and with offsets).
• Add a regression test ensuring cross-file timeline ordering is chronological when timestamps are RFC 3339.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[adamgell]

We can get better with filtering and sorting. We can also go further in parsing the appworkload. @copilot plan out these changes.

I want to see all the context around a failed app. not just a little bit.

also want to send to clipboard button that will copy the error for the user and all the context.

AppWorkload-20260401-160729.log
AppWorkload.log
AppWorkload-20260401-190042.log

[Copilot]

We can get better with filtering and sorting. We can also go further in parsing the appworkload. @copilot plan out these changes.

I want to see all the context around a failed app. not jus...

Addressed in ba4e981. Failed AppWorkload rows now carry a much larger per-app context bundle (current subgraph plus nearby same-GUID lines), the expanded row shows that context in a larger pane, and there’s a new Copy error + context action for sharing the failure details. I also added focused regression coverage for the copy action.

Screenshot: https://github.com/user-attachments/assets/526d9d06-51b4-4083-83e8-d8779fa66234