- alerting.md: updated section overview for all three alerting systems
- alerting/choose-an-alerting-system.md: new comparison and selection guide
- alerting/kibana-alerting-experimental.md: new experimental alerting features overview with concepts glossary and Dispatcher entry
- explore-analyze/images/rule-alert-mode-diagram.png, rule-detect-mode-diagram.png: new diagrams
- toc.yml: navigation entries for new pages

Applies naming guidelines throughout. Cross-references to pages in later PRs are commented out with TODO notes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…moves detailed mode walkthrough to new page (#7208)

<!--
Thank you for contributing to the Elastic Docs! 🎉
Use this template to help us efficiently review your contribution.
-->

## Summary
<!--
Describe what your PR changes or improves.  
If your PR fixes an issue, link it here. If your PR does not fix an
issue, describe the reason you are making the change.
-->

Refines the experimental alerting system overview page and adds a new
"How it works" reference page for readers who want a detailed breakdown
of the system's execution flow.

### Reasoning for changes

The overview page was doing two jobs at once — introducing the system to
new readers and documenting the detailed execution flow for people who
needed to understand the mechanics. Mixing those audiences on one page
made both experiences worse: the intro felt cluttered and the technical
detail was hard to find.

This change splits the two. The overview stays focused on what the
system is and how the pieces relate, using plain language that works for
someone seeing it for the first time. The new "How it works" page gives
engineers and technically curious readers a clean step-by-step breakdown
of what each component does at each stage, organized by rule mode, with
a note on the dispatcher's independent polling cycle that the original
ASCII diagrams obscured rather than clarified.

The practical result is that a new user reading the overview gets a
cleaner introduction, and someone debugging a notification delay or
trying to understand the execution order has a dedicated page they can
go to directly.

### kibana-alerting-experimental.md

- Added a plain-language "How the pieces fit together" section that
explains the rule-to-episode-to-action-policy-to-workflow flow at a high
level before the mode-specific detail.
- Rewrote the Alert and Signal mode descriptions to be accurate about
the polling-based execution model and accessible to readers who are new
to the system.
- Removed ASCII flow diagrams and the detailed Alert/Signal mode
sections, which are now covered by the new how-it-works.md page.
- Added a reference to how-it-works.md at the end of the "How the pieces
fit together" section.

### kibana-alerting-experimental/how-it-works.md (new)

- Documents the step-by-step execution flow for Alert mode (9 steps) and
Signal mode (3 steps) using actor/action tables instead of ASCII
diagrams.
- Includes a note clarifying that action policy evaluation (steps 4–6
and 8–9) runs on a separate background process that polls roughly every
5 seconds, not synchronously with the rule's execution.
- Includes concrete examples for each mode.

### Other

- Deleted rule-alert-mode-diagram.png and rule-detect-mode-diagram.png
(no longer referenced).
- Updated toc.yml to add how-it-works.md as a child of the overview
page.

## Generative AI disclosure
<!--
To help us ensure compliance with the Elastic open source and
documentation guidelines, please answer the following:
-->
1. Did you use a generative AI (GenAI) tool to assist in creating this
contribution?
- [x] Yes - Cursor + Claude
- [ ] No  
<!--
2. If you answered "Yes" to the previous question, please specify the
tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.).

Tool(s) and model(s) used:
-->

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>