Inside ORACLE: How AVA Triages Alerts Like a Senior Analyst