NBK-178: accept MCP-compatible relative DDSQL timestamps

[nmuldavin]

Linear

NBK-178 — https://linear.app/datadoghq/issue/NBK-178/pup-ddsql-from-to-accept-mcp-compatible-relative-timestamps

Outcome

Pup accepts MCP-compatible now-<duration> timestamps for DDSQL envelope bounds while retaining its existing time formats.

Scope

• Extend the shared pup time parser used by ddsql table and security findings analyze to accept forms such as now-24h.
• Document supported --from / --to formats in DDSQL and security findings help.
• Preserve existing bare relative durations, RFC 3339 timestamps, calendar dates, Unix seconds, and Unix milliseconds.
• Do not change DDSQL query execution, API endpoints, or response handling.
• Stack on the merged NBK-161 / NBK-161: migrate DDSQL execution to public v2 API #785 head at commit 34c24a6.

Acceptance

• ddsql table --from now-24h --to now builds the corresponding Unix-millisecond v2 envelope.
• security findings analyze builds its existing Advanced Query API envelope from the same timestamp forms.
• Existing timestamp formats remain covered and accepted.
• Command help lists accepted formats and includes a now-24h example.
• Invalid values fail before an API request and identify --from or --to.

Validation

• cargo test --all -- --test-threads=1 — passed; 1,907 tests after rebasing onto the latest NBK-161: migrate DDSQL execution to public v2 API #785 head.
• cargo clippy --all-targets -- -D warnings — passed.
• cargo fmt --check — passed.
• cargo build — passed.
• cargo test mcp_compatible_relative_time -- --test-threads=1 — passed; parser and both DDSQL request builders exercised.
• cargo test test_ddsql_time_help_documents_supported_formats -- --test-threads=1 — passed.
• Local invalid-input CLI probes — ddsql table returned invalid --from; security findings analyze returned invalid --to, both before network execution.

Not run / automation gaps

• cargo audit — unavailable because cargo-audit is not installed; this change adds no dependencies.
• No live Datadog API query was run; request-envelope behavior is covered by deterministic unit tests.

Material deviations and decisions

• The shared parser extension also makes now-<duration> available to other pup commands using that parser; existing semantics are unchanged.
• GitHub could not use NBK-161: migrate DDSQL execution to public v2 API #785's fork-only head branch as an upstream PR base, so this PR targeted main with NBK-161: migrate DDSQL execution to public v2 API #785's commits as direct ancestors. Now that NBK-161: migrate DDSQL execution to public v2 API #785 is merged, GitHub shows the child-only four-file diff.

Remaining work or conditions

• Human approval to leave draft, followed by review.