This ad-hoc case expects the agent to:

- resolve the latest completed Beijing `11:00-11:05` window for `the primary premium cluster`
- rank the top 3 `tidb`, top 3 `tikv`, and top 3 `pd` nodes separately by
  average CPU overload during that 5-minute window
- use K8s pod names like `db-tidb-1`, `db-tikv-23`, `db-pd-0` as node ids
- compute `avg_cpu_overload` from:
  - `rate(process_cpu_seconds_total{component="<component>"}[1m])`
  - divided by the component-specific CPU quota / maxprocs metric
- for each selected node, count the total number of `ERROR` / `WARN` /
  `WARNING` log lines in the same window, deduping repeated hits across
  different selectors
- return only a structured JSON payload with:
  - `cluster_id`
  - `window`
  - `evidence_sufficient`
  - `ranked_nodes[]` containing `component`, `rank`, `node`,
    `avg_cpu_overload`, and `error_warn_log_count`

The runtime reference judges all fields above.