Incident response

See docs/runbooks/incident-response.md in the repository source.

Do not include secrets, private endpoints, raw production journals, or unredacted infrastructure captures in public reports.