Fix guides/security-analyzer: retention never runs without retention_check_interval

The guide sets retention_check_enabled and retention_period but no
retention_check_interval. RetentionBuilder::build() returns None when
check_interval is unset, so the retention task never starts — silently, with no
warning. With refresh_mode: append nothing else evicts old rows, so the
guide's claim that retention_period keeps a month of history does not hold.

Add retention_check_interval: 1h, say why both settings are needed, and add
the missing step that starts the runtime and runs analyzer.py — the guide
defines the script but never tells the reader to run it.

Author: Claude

guides/security-analyzer/README.md

@@ -93,6 +93,7 @@ datasets:
       refresh_check_interval: 5s
       retention_check_enabled: true
       retention_period: 30d
+      retention_check_interval: 1h
     params:
       pg_host: ${env:PG_HOST}
       pg_port: ${env:PG_PORT}
@@ -106,7 +107,7 @@ Let's break down these configuration choices:
 
 - `refresh_mode: append` optimizes for real-time log ingestion by only appending new data based on the `time_column`
 - `refresh_check_interval: 5s` provides near-real-time analysis
-- `retention_period: 30d` keeps a month of history for pattern analysis
+- `retention_period: 30d` with `retention_check_interval: 1h` keeps a month of history for pattern analysis, sweeping expired rows hourly. Both are required: without `retention_check_interval` the retention check never starts, and in `append` mode nothing else evicts old rows.
 
 ## Adding AI-Powered Analysis
 
@@ -259,6 +260,18 @@ if __name__ == "__main__":
     analyzer.analyze_patterns()
 ```
 
+## Running the Analyzer
+
+Start the runtime, then run the analyzer in a second terminal:
+
+```bash
+spice run
+```
+
+```bash
+uv run analyzer.py
+```
+
 ## Testing the System
 
 To see our security copilot in action, let's simulate some suspicious patterns: