[Observability] Fix KQL autocomplete in custom threshold rule creation

[cesco-f]

It closes #249869

Related to: #246674

Summary

• Fixes KQL autocomplete not working in the custom threshold rule creation/editing form
• The kql service is now injected directly into the rule expression component via a factory function
• This ensures KQL autocomplete works regardless of which plugin opens the rule form (e.g., infra, triggers_actions_ui, stack_alerts) — consumers no longer need to have kql in their plugin dependencies
• Moves kql from optional to required plugins in the observability plugin manifest

Technical details

Problem

The custom threshold rule can be opened from multiple plugins (observability, infra, triggers_actions_ui). Previously, the rule expression component tried to get the kql service from the Kibana context, but this failed when the rule form was opened from plugins that don't have kql in their dependencies.

Additionally, rule types are registered during the setup phase, but KqlPluginStart is only available during the start phase.

Solution

The kql service is now directly injected into the custom threshold rule expression component using a factory function. This approach:

1. Ensures consistency: The kql service always comes from the observability plugin (which owns the rule type), not from the consumer plugin
2. Avoids breaking other plugins: Plugins like infra, triggers_actions_ui, or stack_alerts don't need to add kql to their dependencies just to use the custom threshold rule
3. Handles the setup/start lifecycle: Uses dynamic() with getStartServices() to defer fetching the kql service until the component is actually rendered

E2E test:

• Added new Scout test to verify KQL autocomplete works in custom threshold rule creation

Before:

Screen.Recording.2026-01-21.at.15.59.54.mov

After:

Screen.Recording.2026-01-21.at.16.01.26.mov

[elasticmachine]

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

[miguelmartin-elastic]

lgtm. Tested it locally ✅

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: b202c25

Failed CI Steps

• FTR Configs #19

Test Failures

• [job] [logs] FTR Configs #19 / serverless observability UI Dataset Quality Dataset quality user privileges "before all" hook for "does not show size and last activity columns for underprivileged data stream"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
observability	1807	1808	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
observability	1.8MB	1.8MB	-279.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
observability	96.3KB	96.8KB	+452.0B

History

• 💔 Build #384937 failed 5bb576c
• 💔 Build #384920 failed fc730e9