Function evaluate_rules 

pub fn evaluate_rules(
    rules: &[AlertRule],
    events: &[RazeriEvent],
    now: DateTime<Utc>,
    previously_fired: &[AlertResult],
) -> Vec<AlertResult>

Evaluate alert rules against a canonical event stream.

This is a pure, deterministic function: identical inputs always produce identical outputs. Deduplication uses previously_fired results to suppress repeated firings within the dedup window.