So far, it looks like it almost works.
One remaining issue is that while the event gets triggered and I get the appropriate notification email, the "Terminate alarm" action on the event does not do anything. The threshold violation remains in the alarm list until cleared manually.
Another (minor) issue is that if a row gets inserted into the table above an existing row is that a deactivation and a violation event are both triggered. That could probably be resolved by not using thresholds and also sending the violation events from the transformation script as well.
One remaining issue is that while the event gets triggered and I get the appropriate notification email, the "Terminate alarm" action on the event does not do anything. The threshold violation remains in the alarm list until cleared manually.
Another (minor) issue is that if a row gets inserted into the table above an existing row is that a deactivation and a violation event are both triggered. That could probably be resolved by not using thresholds and also sending the violation events from the transformation script as well.