feat(issues): Implement EAP group search for issue feed queries

[shashjar]

PR 1/2 to implement issue feed search via EAP queries. Precursor to #112996.

• Adds search_filters_to_query_string() to convert legacy Snuba SearchFilter objects into EAP-compatible query strings
• Adds run_eap_group_search() which provides issue feed search capability via EAP

[sentry]

Bug: The AGGREGATION_FIELD_TO_EAP_FUNCTION map is missing an entry for first_seen, causing search queries filtering on this field to fail or be processed incorrectly.
_{Severity: MEDIUM}

Suggested Fix

Add the missing 'first_seen': 'first_seen()' key-value pair to the AGGREGATION_FIELD_TO_EAP_FUNCTION dictionary to ensure filters on this field are correctly converted to function calls.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: src/sentry/search/eap/occurrences/search_executor.py#L52-L56

Potential issue: The `AGGREGATION_FIELD_to_EAP_FUNCTION` dictionary is missing an entry
for `first_seen`. Because `first_seen` is a supported aggregate filter, when a search
query containing a filter like `first_seen:>2024-01-01` is processed, it is not
correctly identified as an aggregation. The logic then falls through to a generic filter
conversion, which incorrectly formats the query as `first_seen:>value` instead of the
required `first_seen():>value`. This causes queries using the `first_seen` filter to
fail or produce incorrect results in the EAP search path.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit da3b0ef. Configure here.}

[cursor]

first_seen missing from aggregation filter mapping

High Severity

AGGREGATION_FIELD_TO_EAP_FUNCTION is missing a "first_seen": "first_seen()" entry. The legacy PostgresSnubaQueryExecutor.aggregation_defs includes first_seen alongside times_seen, last_seen, and user_count, causing first_seen filters to be routed as HAVING clauses. Without this mapping, a filter like first_seen:>2024-01-01 won't be converted to first_seen():>2024-01-01 and will instead fall through to regular column filter handling, producing incorrect results or silently becoming a dynamic tag lookup.

 

^{Reviewed by Cursor Bugbot for commit da3b0ef. Configure here.}